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ABSTRACT 


This  thesis  investigates  the  possibility  of  geoloeating  a  WiMAX  subscriber  station 
based  on  the  timing  adjust  ranging  parameter  within  the  network  signal  internals.  The 
basic  approach  to  geolocation  based  on  radial  distances  from  multiple  base  stations  is 
outlined.  Specifics  of  the  timing  parameters  used  during  WiMAX  network  entry  are 
examined  as  they  relate  to  calculating  these  distances.  Laboratory  testing  demonstrates 
successful  capture  of  ranging  parameters  from  the  air  interface,  leading  to  the 
development  of  a  web  based  geolocation  tool  to  map  likely  locations  of  subscriber 
stations.  Field  collection  of  the  air  interface  from  a  single  base  station  network  verified  a 
high  correlation  with  low  variance  when  comparing  values  in  timing  adjust  values  in 
packets  exchanged  during  network  entry.  Using  field  test  results,  computer  simulation 
further  refined  the  expected  geolocation  accuracy  in  multiple  base-station  networks. 
Results  show  the  possibility  of  fixes  with  10  times  greater  accuracy  than  in  previous 
results  in  literature  applying  timing  advance  techniques  to  Global  System  for  Mobile 
communications  networks. 
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EXECUTIVE  SUMMARY 


WiMAX  is  an  important  emergent  technology.  It  can  provide  fixed  data  access  in 
developing  areas  without  the  costly  need  for  cable  infrastructure  and  is  poised  as  one  of 
the  two  technologies  that  will  replace  current  3G  cellular  network  as  infrastructure 
converges  on  a  voice  over  internet  protocol  network  and  mobile  subscribers  use  more  and 
more  data.  Since  WiMAX’s  high  speed  connection  is  wireless,  a  fixed  or  mobile 
subscriber’s  location  is  not  predetermined.  There  are  many  instances  in  which  locating  a 
WiMAX  subscriber  may  be  important  including  emergency  response  to  a  medical 
emergency  or  fire  and  aiding  in  law  enforcement  and  homeland  security. 

There  are  many  methods  to  geolocate  a  radio  frequency  device,  and  each  has 
tradeoffs  and  limitations.  Time  difference  of  arrival  requires  very  precisely  synchronized 
receivers  and  frequency  difference  of  arrival  requires  significant  velocities  to  generate 
Doppler  shifts.  While  one  solution  is  to  simply  install  GPS  chips  in  subscriber  units,  this 
adds  cost  to  manufacture,  and  requires  the  subscriber  unit  to  be  cooperative  to  provide  its 
location.  Rather  then  relying  on  a  phone  to  transmit  its  own  internally  collected  location, 
a  network-ranging  feature  built  into  the  WiMAX  standard  called  timing  adjust  can  be 
exploited  to  derive  the  distance  from  known  points,  such  as  cell  towers,  to  establish  a 
geolocation. 

In  a  WiMAX  network,  similar  to  a  Global  System  for  Mobile  communications 
cellular  network,  different  stations  take  turns  transmitting  at  different  times  to  share  the 
link.  However,  the  messages  of  subscribers  at  different  distances  from  the  tower  take 
different  lengths  of  time  to  reach  the  tower  depending  on  their  distance  to  the  tower.  To 
correct  for  this  so  that  the  base  station  receives  each  subscriber’s  data  in  the  appropriate 
time  slot  without  interfering  with  other  users,  the  base  station  sends  out  timing  adjusts  to 
tell  each  individual  subscriber  to  transmit  sooner  or  later  so  its  data  arrives  in  the  right 
time  window. 

By  listening  to  this  exchange  over  the  air  interface,  it  is  possible  to  extrapolate 
what  distance  away  from  the  tower  a  subscriber  is,  based  on  the  propagation  speed,  the 
speed  of  light,  and  how  many  timing  adjust  units  the  base  station  tells  the  subscriber  to 


XV 


use.  Previous  studies  had  explored  using  this  method  to  geolocate  Global  System  for 
Mobile  communications  cell  phones,  and  the  objective  of  this  thesis  was  to  apply  these 
principles  to  WiMAX  networks  despite  different  radio  frequency  parameters  and  message 
formats. 

WiMAX  was  developed  to  support  a  common  media  access  layer  on  top  of 
different  physical  layers  (different  frequencies  and  bandwidths),  so  the  signaling 
parameters  may  vary  from  network  to  network  and  in  different  regions  of  the  world,  but 
overall  principles  will  consistently  apply  across  standard  compliment  WiMAX  devices. 
For  testing,  a  network  was  used  that  resulted  in  a  theoretical  distance  per  unit  of  timing 
adjust  of  52  m  based  on  the  physical  layer  parameters. 

After  initial  laboratory  testing  confirmed  that  the  appropriate  timing-adjust 
messages  could  be  captured  from  the  air  interface  and  conformed  to  the  format  expected 
from  the  standard’s  documentation,  a  methodology  for  geolocation  based  on  two 
collected  radii  was  developed  and  implemented  in  a  web-based  mapping  interface. 
Taking  a  collection  suite  consisting  of  a  laptop,  GPS  unit,  and  one  collection  and  analysis 
box,  vehicle-based  field  collection  was  then  conducted  at  distances  more  realistic  to  a 
deployed  cellular  network  simulating  real  world  application. 

Testing  in  the  laboratory  and  field  tests  both  showed  that  timing  adjust  did  in  fact 
linearly  correlate  to  distance,  making  it  possible  to  approximate  the  subscriber  unit’s 
distance  from  the  base  station  based  on  information  collected  from  the  air  interface. 
Further,  repeated  captures  of  ranging  packets  at  fixed  distances  showed  very  low  variance 
in  the  timing  adjust  value  received,  again  indicating  the  ability  to  accurately  geolocate  a 
subscriber  based  on  this  information. 

Though  limited  to  one  base  station  for  testing,  computer  simulation  using  the 
results  of  the  tests  from  the  single  base  station  extended  the  results  to  model  numerous 
multiple  base-station  networks.  Results  from  the  simulation  showed  that  in  networks  with 
various  numbers  of  towers  and  random  tower  placements,  the  location  of  a  subscriber 
could  generally  be  determined  within  50  meters  if  accurate  tower  locations  and  timing 
adjust  offsets  are  known. 
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Geolocation  within  50  meters  based  on  passive  collection  of  the  air  interface 
offers  great  potential,  both  to  cellular  networks  hoping  to  offer  location  based  services 
and  to  emergency  response  and  tactical  personnel  who  may  need  to  locate  mobile  persons 
of  interest.  Both  testing  and  simulation  demonstrate  the  possibility  of  developing  such  a 
fieldable  capability  in  a  WiMAX  network  based  on  signal  internals  captured  from  the  air 
interface. 
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I.  INTRODUCTION 

A.  BACKGROUND:  WIMAX  AND  WHY  WE  CARE 

The  IEEE  802.16-2001  standard  published  in  April  2002  defines  a  wireless 
metropolitan  area  network,  designed  to  distribute  a  high-speed  networking  capability 
without  the  costly  need  for  cabled  infrastructure.  The  standard  was  designed  to  evolve 
with  a  common  media  access  control  (MAC)  protocol  with  different  physical  layer 
considerations  dependent  on  the  spectrum  employed  [1].  Since  the  initial  publication  in 
2002,  several  related  projects  in  the  802.16  working  group  have  extended  the  scope  and 
capabilities  of  the  initial  2001  standard,  most  notably  the  802.16d-2004  fixed  standard 
and  206.16e-2005  mobile  standard  [2]. 

The  fixed  wireless  standard  provides  the  capability  for  leap-frog  advancement  in 
connectivity  without  the  high  costs  associated  with  the  need  to  run  cable  to  every 
subscriber.  In  underdeveloped  areas,  including  rural  areas  and  developing  nations,  fixed 
802. 16d  provides  a  means  of  distributing  high-speed  data  transfer  while  completely 
bypassing  the  build  out  of  a  fiber  or  copper  infrastructure.  Even  in  urban  areas,  fixed 
802. 16d  has  been  suggested  as  a  backhaul  technology  for  localized  802.1 1  hotspots. 

The  mobile  standard  has  been  envisioned  as  a  fourth  generation  replacement  to 
current  cellular  mobile  subscriber  phone  and  data  services,  increasing  data  throughput. 
Mobile  802. 16e  offers  greater  data  rates  than  current  3G  cellular  technologies,  while 
providing  greater  mobility  than  802.1 1.  Antennas  for  802.16  can  be  added  to  current  cell 
towers,  taking  advantage  of  the  existing  towers  and  backhaul  links,  while  providing 
increased  data  throughput  on  the  mobile  network.  The  mobile  802.16  standard  offers 
great  opportunity  for  continuing  convergence  of  voice  and  data  networks  and  growing 
consumer  demand  for  greater  data  throughput  to  mobile  devices. 

Just  as  Wi-Fi  was  developed  as  a  common  subset  of  the  802. 1 1  standard  to  ensure 
compatibility  between  vendors.  Worldwide  Interoperability  for  Microwave  Access 
(WiMAX)  is  an  industry  consortium  to  certify  products  that  must  commonly  comply  with 
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specified  aspects  of  the  802.16  standard.  While  this  leaves  room  for  different  hardware 
implementation  and  special  features  for  vendors  to  differentiate  themselves,  it  also 
ensures  that  there  is  commonality  in  initialization  and  establishing  communications 
between  base  stations  (BS)  and  subscriber  stations  (SS).  Several  PlugFest  events  have 
been  hosted  in  coordination  with  the  WiMAX  forum  where  vendors  demonstrated 
interoperability,  and  this  interoperability  is  specifically  advertised  as  a  selling  point 
[3], [4].  This  commonality  benefits  industry  through  standardization  of  components  that 
reduces  cost  through  volume.  It  also  benefits  the  consumer  through  competition  between 
vendors  and  network  administrators  through  the  development  of  standardized  diagnostic 
equipment  to  examine  networks  and  links. 

Already,  many  WiMAX  networks  have  been  built  out  globally,  with  many  more 
planned.  While  economic  recession  has  slowed  investment  in  new  technology  and 
infrastructure,  as  noted  above,  in  many  cases  using  the  leapfrog  technology  is  still  more 
cost  effective.  The  map  in  Figure  1  shows  currently  deployed  WiMAX  systems  across  the 
globe  [5]. 


Figure  1.  WiMAX  Forum  WiMAX  Deployment  Map  (From  [5]). 
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Growing  build  out  of  an  emerging  global  standard,  with  industrial  partnerships  to 
ensure  interoperability,  strongly  suggests  that  WiMAX  is  the  wave  of  the  future,  offering 
both  mobility  and  high  data  throughput.  As  consumers,  both  civil  and  government,  begin 
to  use  and  rely  on  this  new  technology,  emergent  features  and  uses  in  the  protocols  are 
worthy  of  examination. 

B.  OBJECTIVE:  GEOLOCATION 

With  the  potential  for  widespread  deployment  of  WiMAX-compliant  devices  in 
the  near  future,  one  important  consideration  is  how  to  locate  subscribers  in  both  fixed  and 
mobile  applications.  Location-based  services  have  grown  increasingly  popular  in  the 
current  generation  of  cellular  phones,  providing  weather,  traffic,  and  navigation 
information  and  even  social-networking  services  to  identify  friends  in  the  area.  Beyond 
commercial  customer  demand  for  location  information,  it  is  important  to  law  enforcement 
for  stolen  property  recovery  and  emergency  response  personnel  who  may  need  to  be  able 
to  quickly  locate  people  in  emergency  situations.  Beginning  in  2003,  Congress  mandated 
standards  for  mobile  carriers  to  be  able  to  provide  accurate  locations  for  the  origins  of 
911  calls  from  mobile  phones  to  respond  to  such  situations  [6]. 

Even  beyond  the  scope  of  emergency  response,  there  may  be  law  enforcement  or 
homeland  security  necessities  to  find  the  location  of  a  threat  using  wireless  or  mobile 
communications.  In  light  of  these  critical  needs  to  locate  subscribers  of  wireless 
technologies,  and  with  WiMAX  poised  to  be  a  dominant  emerging  wireless  standard,  this 
thesis’s  objective  is  to  develop  a  method  to  geolocate  WiMAX  subscribers  and  assess  the 
fix  accuracy  that  can  be  achieved  using  this  technique. 

C.  RELATED  WORK:  METHODS  OF  GEOLOCATION 

There  are  several  means  of  addressing  the  issues  of  locating  wireless  devices 
through  both  handset-based  and  network-based  solutions.  A  global  position  system  (GPS) 
chip  built  into  a  mobile  unit  can  provide  accurate  location  data  satisfying  the 
Congressional  requirement  for  an  E-911  situation,  but  has  several  drawbacks.  A  GPS 
device  increases  the  cost  to  manufacture  and  power  draw  on  the  mobile  device,  while 
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requiring  the  transmission  of  extra  data.  An  external,  passive  approach  to  location  trades 
off  some  location  resolution  but  overcomes  the  cost,  power,  and  bandwidth  penalties  of  a 
GPS  solution.  It  also  continues  to  provide  a  location  capability  even  if  the  GPS  location 
capability  should  malfunction  or  be  maliciously  disabled,  which  may  be  critical  in  law 
enforcement  or  homeland  security  situations  requiring  location  data. 

Several  possible  passive  external  techniques  exist  to  locate  a  radio  frequency  (RF) 
devices,  including  received-signal-strength  indication  (RSSI),  angle  of  arrival  (AOA), 
time  difference  of  arrival  (TDOA),  frequency  difference  of  arrival  (FDOA),  or  potential 
internal  signal  characteristics  [2], [7].  Direct  application  of  RSSI  has  many  limitations 
including  multipath  and  variable  broadcast  strength  and  does  not  provide  a  robust, 
reliable  means  of  location.  FDOA  requires  significant  relative  motion  to  generate 
Doppler  shift,  and  while  platforms  such  as  aircraft  maybe  able  to  employ  it,  it  is 
infeasible  for  terrestrial  geolocation.  This  leaves  consideration  of  AOA,  TDOA,  and 
signal  internals,  or  some  combination  thereof,  as  the  best  possibility  for  locating  an 
802.16  subscriber. 

In  looking  to  the  future,  it  is  best  to  begin  with  what  has  already  been  done. 
Currently,  the  nationwide  time  division  multiple  access  (TDMA)  and  Global  System  for 
Mobile  communications  (GSM)  cellular  providers  use  network-based  location 
technology;  both  Cingular  and  T-Mobile  employ  TDOA  technologies.  This  approach  is 
likely  driven  by  the  structure  of  the  signal  itself,  since  in  both  TDMA  and  GSM 
significant  timing  data  is  built  in  to  control  access  to  the  shared  spectrum.  The  code 
division  multiple  access  (CDMA)  providers,  including  Sprint  and  Verizon,  have  opted  for 
an  assisted  GPS  solution  to  meet  the  legal  E-91 1  requirements  imposed  by  Congress  [6]. 

GSM  mobile  stations  can  be  located  within  several  hundred  meters  based  on  an 
internal  parameter  for  time  of  arrival  called  timing  advance.  Timing  advance  is  used  by 
the  network  and  handset  to  align  the  traffic  bursts  with  the  TDMA  frames  of  GSM.  Using 
this  timing  advance  and  speed  of  propagation,  range  rings  from  base  station  towers  can 
be  approximated,  and  the  intersection  of  these  range  rings  from  multiple  towers  provides 
an  approximate  location  for  the  mobile  station  [8].  Further  refinement  of  this  approach 
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found  averaging  multiple  timing  advance  measurements  minimized  error  in  random 
variable  sampling,  tightening  location  accuracy  [9]. 

D.  APPROACH 

The  uplink  in  the  802.16  MAC  is  also  shared  between  SSs  in  a  TDMA  fashion, 
with  initial  assignment  of  a  timing  adjust  (TA)  generated  by  the  BS  after  the  initial  entry 
and  ranging  request  by  a  SS  [1].  This  parallel  to  GSM  creates  an  opportunity  to  leverage 
similar  location  techniques,  dependent  on  access  to  the  network  at  the  BS  or  being  able  to 
receive  this  information  over  the  air  interface  with  the  known  BS  locations.  This  is  the 
approach  to  geolocation  used  in  this  thesis,  using  timing  data  in  the  signal  internals  to 
establish  ranges  to  various  known  tower  locations  as  has  been  previous  explored  with 
GSM. 

To  begin,  the  802.16  standards  were  investigated  to  identify  which  packets 
contain  this  timing  data,  when  they  occur  in  traffic,  and  what  the  bits  encoded  in  the 
packets  mean.  After  establishing  the  expected  parameters  from  specifications  and 
literature,  laboratory  testing  confirmed  that  these  bits  can  be  extracted  from  packets  on 
the  air  interface  in  a  controlled  environment.  Following  laboratory  testing,  field  testing 
confirmed  linear  correlation  between  TA  and  real-world  distances.  Field  testing  also 
established  the  variance  in  TA  for  repeated  measurements  at  fixed  distances,  critical  to 
assessing  fix  accuracy.  Having  observed  TA-parameter  behavior  in  a  simple  fielded 
network,  computer  simulation  was  used  to  extend  these  results  to  multi-BS  networks, 
establishing  fix  accuracy  for  geolocations  based  on  the  TA  ranging  parameter  in  WiMAX 
networks. 


Figure  2.  Illustration  of  Overlapping  Timing  Advance  Range  Rings. 
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E.  THESIS  ORGANIZATION 


Chapter  II  begins  the  exploration  of  the  802.16  standards.  Detailed  analysis  of  the 
initial  entry  procedures  specified  in  the  802.16  standards,  as  used  in  WiMAX  devices, 
indicate  the  windows  of  opportunity  to  observe  TA  packets  and  what  information  is 
expected  to  be  contained  within  them.  Laboratory  testing  verifying  the  ability  to  capture 
the  needed  packets  from  the  air  interface  is  then  examined  in  Chapter  III.  After  having 
established  the  expected  TA  parameters  and  verified  the  ability  to  observe  them  over  the 
air  interface.  Chapter  IV  develops  the  computer  tools  and  supporting  mathematics  to 
establish  geolocations  based  on  these  parameters. 

With  the  background  of  packets  and  methods  established.  Chapter  V  sets  out  for 
field  testing,  describing  both  experimental  procedures  and  results  of  trails  conducted  from 
short  ranges  to  distances  extending  to  1.3  km.  Excellent  linearity  and  low  variance  are 
observed,  which  establish  the  statistical  parameters  used  in  further  simulation.  Chapter  VI 
takes  the  results  from  Chapter  V’s  field  testing  and  applies  them  to  several  Monte  Carlo 
simulations,  establishing  the  expected  fix  accuracy  in  real-world  WiMAX  network 
implementations.  Finally,  Chapter  VII  pulls  together  these  results  and  recommends 
potential  avenues  for  further  exploration  and  refinement  of  this  method. 
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II.  WIMAX  WORKINGS 


The  802.16  standard  incorporates  many  features  making  it  appealing  on  different 
levels.  From  the  beginning,  it  is  a  convergent  technology  designed  to  work  with  internet 
protocol  (IP)  applications  at  the  upper  levels  of  the  protocol  stack,  allowing  for  both 
voice  over  IP  (VoIP)  and  data  transfer.  As  more  telephony  shifts  toward  VoIP 
transmission  over  the  backbone  networks,  this  allows  for  seamless  interoperability  all  the 
way  to  the  handset.  At  the  same  time,  while  current  schemes  to  move  data  to  cell  phones 
are  adaptations  shoehomed  into  what  was  designed  to  be  a  voice  channel,  shifting  to  a 
converged  IP  architecture  again  allows  for  more  seamless  integration  of  the  handset  into 
the  larger  data  network.  At  the  physical  layer,  802.16  allows  for  the  use  of  many  different 
parts  of  the  spectrum  offering,  and  WiMAX  provides  for  a  flexible  subset.  Variable¬ 
encoding  schemes  are  available  depending  on  channel  conditions,  and  the  use  of 
orthogonal  frequency  division  multiplexing  (OFDM)  provides  high  throughput  and 
robustness  against  multipath  issues. 

OFDM  may,  at  the  onset,  seem  somewhat  intimidating,  but  can  essentially  be 
thought  of  much  like  traditional  frequency  division  multiplexing.  Different  frequencies 
carry  different  pieces  of  information,  just  as  different  radio  stations  have  different  music 
on  different  frequencies.  In  OFDM,  one  radio  station  just  works  with  a  group  of 
frequencies  rather  than  a  single  carrier.  By  subdividing  the  allotted  bandwidth  to  use 
carefully  spaced  frequencies,  multiple  symbols  amalgamated  via  Inverse  Fast  Fourier 
Transform  (IFFT)  can  be  sent  simultaneously.  Through  calculated  selection  these  sub 
bands  can  be  spaced  orthogonally,  avoiding  any  inter  symbol  interference  (ISI). 

Beyond  tightly  packing  many  carriers  in  the  allotted  bandwidth,  these  narrower 
frequency  bands  are  in  turn  wider  in  time.  Symbols  that  are  wider  in  time  are  much  less 
susceptible  to  time-smearing  effects  of  multipath  propagation,  where  the  signal  is 
received  as  many  different  modes  and  reflections.  There  is  of  course  a  trade-off  in  that 
the  narrower  the  frequency  bands  become,  the  more  susceptible  the  signal  is  to  Doppler 
shift,  and  frequency  shifts  can  lead  to  the  nulls  failing  to  align,  creating  significant  ISI. 
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As  an  example  of  the  frequency  subdivision  of  OFDM,  our  fixed  WiMAX  test  equipment 
uses  a  bandwidth  of  3.5  MHz  divided  by  an  IFFT  size  of  256  (a  table  of  WiMAX  profiles 
is  included  in  Appendix  A)  [10]. 

Given  OFDM’s  relative  time-robustness,  one  may  wonder  why  an  accurate 
timing-adjustment  mechanism  is  needed  and  included  in  the  standard.  The  answer  lies  in 
the  media  access  (MAC)  layer,  between  the  physical  signaling  implemented  via  OFDM 
and  higher  IP  functionality.  In  order  to  control  access  to  the  shared  wireless  medium,  a 
time  division  duplexing  (TDD)  scheme  is  used  where  first  the  BS  transmits  its 
information  during  the  downlink  before  SS  are  allowed  to  transmit  their  information 
during  allotted  times  during  the  uplink.  The  BS  acts  as  controller,  scheduling  and 
granting  access  to  certain  uplink  bursts  to  specific  SS  in  order  to  maximize  throughput  in 
a  contention  free  manner.  To  initially  enter  a  BS’s  network,  there  is  a  contention  channel 
and  time  window  for  SS  to  submit  their  requests,  but  once  established,  the  BS  sends  out 
both  a  downlink  and  an  uplink  map,  telling  the  SS  when  to  listen  for  their  information 
and  when  they  are  free  to  send. 

In  order  to  keep  this  process  functioning  in  an  orderly  manner,  it  is  important  for 
each  SS  to  transmit  their  data  at  the  correct  time  for  it  to  arrive  at  the  BS  in  its  designated 
uplink  slot.  Timing  for  the  downlink  is  established  since  all  stations  use  the  preamble  at 
the  beginning  of  the  frame  as  a  timing  reference  and  simply  count  slots  back  from  the 
beginning  of  the  frame.  Any  delay  in  the  downlink  arriving  at  SS  is  then  irrelevant  since 
the  frame  clock  starts  when  the  frame  arrives.  However,  on  the  uplink,  since  the  data  the 
SS  is  sending  is  still  part  of  this  frame,  propagation  time  must  be  accounted  for  so  that  the 
SS’s  information  arrives  at  the  BS  in  the  correct  slots  as  assigned  in  the  uplink  map. 
Because  of  this  TA  is  a  critical  component  of  ranging. 

A.  NETWORK  ENTRY  AND  RANGING 

As  previously  mentioned,  in  order  to  join  a  BS  a  SS  must  compete  in  a  contention 
window,  be  recognized  by  the  BS,  and  assigned  frame  slots.  When  initialized,  a  SS  scans 
its  allowed  frequencies  (as  provided  by  the  service  provider’s  network)  to  see  if  a 
WiMAX  network  is  available.  Once  a  BS  frequency  is  acquired,  the  SS  listens  for  the 
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frame  preamble  to  synchronize  itself.  After  preamble  synchronization,  the  first  thing  the 
BS  transmits  is  the  frame  control  header  (FCH)  followed  by  a  downlink  burst  containing 
broadcast  messages.  The  FCH  and  this  downlink  contain  information  on  modulation,  the 
downlink  and  uplink  maps,  and  channel  descriptors.  Figure  3  illustrates  the  sequence  of 
this  data  occurring  in  the  WiMAX  frame.  Based  on  this  information,  the  SS  can 
determine  whether  this  BS  frequency  will  suitably  accommodate  it  or  if  it  needs  to 
continue  scanning. 

If  the  SS  finds  the  BS  frequency  suitable,  it  will  also  be  able  to  find  the  contention 
opportunities  for  initial  ranging.  During  this  contention  slot  for  ranging,  a  ranging  code, 
selected  from  a  known  set  of  pseudo  noise  (PN)  codes,  is  modulated  via  binary  phase 
shift  keying  (BPSK)  and  transmitted  over  consecutive  OFDM  symbols  specially 
appended  without  phase  discontinuity.  BPSK  provides  the  greatest  robustness  of  the 
modulation  schemes  available  in  WiMAX  and  the  PN  codes  allow  the  BS  to  separately 
detect  a  SS  if  a  collision  occurs  during  initial  ranging.  If  the  SS  does  not  receive  a 
response  from  the  BS  after  a  certain  time,  it  assumes  ranging  was  unsuccessful,  and 
begins  back  off  to  enter  a  contention  resolution  phase  before  reattempting  entry. 


Downlink 


Uplitik 


Figure  3.  WiMAX  Frame  Format. 
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If  the  BS  properly  receives  the  initial  ranging  request  (RNG-REQ),  it  responds 
with  a  ranging  response  (RNG-RSP)  message  during  the  next  downlink,  which  indicates 
to  the  SS  any  adjustments  needed  to  its  power,  frequency,  and  timing.  This  initial 
response  contains  the  MAC  address  of  the  SS  for  identification  purposes,  but  also  assigns 
a  connection  identifier  (CID)  which  will  be  used  to  address  the  SS  in  further  traffic.  The 
SS  will  again  transmit  a  RNG-REQ  during  its  uplink  slot  and  receive  either  a  RNG-RSP 
message  for  further  adjustments  or  a  RNG-RSP  indicating  the  ranging  status  is  complete. 
The  ranging  handshake  is  shown  in  Figure  4. 

Following  initial  ranging,  network  entry  continues  by  negotiating  services, 
authenticating  and  registering  with  the  network,  obtaining  an  IP  address,  and  obtaining 
other  parameters  as  illustrated  in  Figure  5  [10]. 

Beyond  network  entry’s  initial  ranging,  ranging  also  occurs  periodically  to 
account  for  changes  in  channel  conditions  and  mobility,  during  bandwidth  requests,  and 
for  handovers.  Handover  ranging  is  particularly  interesting  for  geolocation  since  the 
message  contains  ranging  from  multiple  BSs  [11]. 
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Figure  4.  Ranging  Procedure  (After  [10]). 


10 


Figure  5.  Network  Entry  Process  (From  [10]). 


B.  RANGE  RESPONSE  MESSAGE 

The  RNG-RSP  message  is  defined  in  the  802.16d-2004  and  802. 16e  standards  to 
contain  a  4-byte  TA  containing  a  32-bit  signed  number;  negative  to  advance  the  burst 
transmission  time  and  positive  to  delay  [11], [12].  The  standard  defines  the  value  to  be 
variable  depending  on  the  physical  layer,  but  commonality  is  expected  between  the  fixed 
and  mobile  WiMAX  standards  based  on  nearly  identical  verbiage  in  the  802.16  standards 
shown  in  Table  1  and  the  focus  on  vendor  TDD  interoperability  [4]. 


802.16d-2004  (Fixed) 

Tx  timing  offset  adjustment  (signed  32-bit).  The  time  required 
to  advance  the  SS  transmission  so  frames  arrive  at  the 
expected  time  instance  at  the  BS.  Units  are  PHY  specific  (see 
10.3). 

802.16e-2005  (Mobile) 

Tx  timing  offset  adjustment  (signed  32-bit).  The  amount  of 
time  required  to  adjust  SS  transmission  so  the  bursts  will 
arrive  at  the  expected  time  instance  at  the  BS.  Units  are  PHY 
specific  (see  10.3).  The  SS  shall  advance  its  burst 
transmission  time  if  the  value  is  negative  and  delay  its  burst 
transmission  if  the  value  is  positive. 

Table  1.  TA  Definitions  from  802.16  Standards  (After  [12], [1 1]). 
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The  expected  consistency  indicates  that  work  on  geolocation  based  on  fixed 
WiMAX  equipment,  which  is  significantly  less  expensive  and  more  readily  available  for 
laboratory  experimentation,  will  be  easily  transferable  to  mobile  WiMAX.  Vendor  TDD 
interoperability  implies  that  observations  on  one  vendor’s  WiMAX  equipment  will  also 
be  a  valid  representation  of  other  vendors  implementations. 

C.  TIMING  ADJUST 

Further  refining  the  expected  range  per  unit  of  TA,  the  PHY  specific  units  as 
described  in  Table  1  are  simply  the  reciprocal  of  the  sampling  frequency.  The  sample 
frequency  is  defined  in  the  standard  as: 

F,  =  floor  {n  -EWmOO)  x  8000  (1) 

The  sampling  factor,  n,  is  dependent  on  the  bandwidth  used  and  also  specified  in 
the  standard.  Appendix  B  contains  a  table  of  OFDM  symbol  parameters  for  802. 16d- 
2004,  including  an  enumeration  of  the  possible  values  of  the  sampling  factor.  For  the 
utilized  bandwidth  of  3.5  MHz,  the  sampling  factor  is  8/7.  Solving  for  with  this 
sampling  factor  and  a  3.5  MHz  bandwidth  gives  4  MHz.  Using  the  speed  of  light, 

O 

approximately  3x10  meters  per  second,  and  a  TA  of  1/Fs,  each  unit  of  TA  should 
correlate  to  a  distance  of  approximately  75  meters. 

This  chapter  has  thoroughly  examined  the  specifics  of  the  WiMAX  entry  process 
as  well  as  addressed  specific  parameters  of  interest.  Initial  ranging  will  occur  at  a 
predefined  time  in  the  uplink  window,  and  responses  from  the  BS  will  include  both  the 
SS  MAC  address  and  the  adjustment  instruction.  TA,  which  is  documented  to  be  the 
same  in  both  fixed  and  mobile  implementations,  is  able  to  be  resolved  to  distance 
allowing  for  a  radial  distance  from  the  BS  to  be  calculated  which  can  be  applied  to 
geolocation  by  means  of  crossing  radii  as  introduced  at  the  end  of  the  previous  chapter. 
Having  detailed  network  entry  and  bit  specifics  from  the  standards,  the  next  chapter 
documents  laboratory  collection  confirming  the  captured  and  decode  signal  is  what  is 
defined  and  expect  from  the  standard. 
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III.  LABORATORY  OBSERVATIONS 


A.  INITIAL  OBSERVATIONS  IN  THE  NFS  NETWORKS  LAB 

To  begin  exploring  the  possibilities  of  geolocating  a  WiMAX  SS  based  on  TA 
values,  as  had  been  explored  with  GSM’s  timing  advance  [8], [9],  traffic  was  first 
analyzed  to  ensure  RNG-RSP  messages  could  be  identified  and  the  necessary  information 
was  discemable  as  suggested  by  the  standard.  A  small  WiMAX  network  was  configured 
in  the  laboratory.  The  network  consists  of  a  Redline  AN-IOOU  BS  and  two  Redline 
RedMAX  SU-0  outdoor  SS.  The  AN-IOOU  was  configured  to  use  a  center  frequency  of 
3.40175  GHz  with  a  3.5  MHz  bandwidth  via  network  interface  and  in  the  laboratory 
connected  to  a  laptop  hosting  a  file  server  application.  The  SS  are  simply  connected  to 
120  V  wall  power  without  need  for  further  configuration  and,  when  attached  to  other 
laptop  terminals,  sustained  network  traffic  could  be  generated. 

Collection  of  the  air  interface  is  achieved  by  an  antenna  situated  between  the  BS 
and  SS,  which  feeds  an  Agilent  4440  Spectrum  Analyzer  and  a  Sanjole  WaveJudge  4800 
WiMAX  analysis  box.  The  WaveJudge  is  a  passive  protocol-analyzer  which  provides 
protocol  and  higher-layer  capture  and  decode  capabilities  and  can  correlate  RF  to  MAC 
data.  Focusing  on  the  MAC,  the  WaveJudge  was  the  primary  observation  instrument, 
able  to  capture  and  decode  up  to  eight  seconds  of  OFDM  symbols  and  display  the  results 
to  a  computer  via  universal  serial  bus  (USB)  data  transfer.  The  limited  capture  time 
shaped  initial  observation  in  limiting  observations  of  the  RNG-RSP  to  initial  ranging,  and 
no  periodic  ranging  was  identified. 

Viewing  the  decoded  traffic,  the  RNG-RSP  was  observed  for  repeated  trials  at  a 
range  of  10.5  meters,  the  length  of  the  lab  room.  Table  2  shows  a  sample  of  the  actual 
bits  in  one  of  the  RNG-RSP  messages,  illustrating  the  time  length  value  format  of  the 
packet,  with  information  type  and  data  length  indicated  before  the  data  bits. 
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Management  Message  Type  5,  Ranging  Status  1  "Continue" 


Type 

#  Bytes 

Value 

Timing  Adjust 

01 

04 

FF  FF  FF  BE 

Power  Level  Adjust 

02 

01 

EB 

Offset  Frequency  Adjust 

03 

04 

00  00  00  7A 

Table  2.  Sample  RNG-RSP  Values. 


Having  successfully  identified  and  verified  the  RNG-RSP  contained  a  fairly 
consistent  TA  at  a  static  range,  the  SS  were  moved  to  assess  the  variability  and  resolution 
of  the  TA  at  different  ranges.  Initial  attempts  to  move  both  the  BS  and  SS  for  maximum 
range  deltas  were  unsuccessful  due  to  in-lab  transmit  power  limitations  and  the 
directional  properties  of  the  laboratory  collection  antenna  precluding  capture  of  traffic 
with  the  BS  relocated.  Since  only  the  downlink  was  of  concern  to  capture  RNG-RSP 
messages,  and  RNG-REQ  were  less  significant,  the  BS  was  left  static  in  its  original  lab 
location,  and  only  the  SS  were  moved.  Later  testing  with  greater  ranges  would  provide 
more  amplifying  data,  but  as  other  students  were  working  on  calibrated  measurements, 
disruption  of  the  collection  equipment  was  not  yet  feasible. 

RNG-RSP  observations  varying  the  distance  to  the  SS  provided  initially 
promising  results.  Figure  6  shows  the  TA  associated  with  range  in  meters.  Of  note, 
repeated  values  at  a  given  range  cluster  since  the  TA  only  takes  on  discrete  values. 
Overall,  the  results  showed  high  correlation  between  range  and  TA,  and  the  TA  for 
repeated  trials  at  fixed  range  showed  a  standard  deviation  of  0.79,  meaning  most  of  the 
time  the  TA  was  plus  or  minus  one  unit. 
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Notably,  at  distances  beyond  12  meters  the  SS  were  moved  out  of  the  laboratory 
where  the  BS  was  located  to  a  passageway.  This  configuration  no  longer  provided  line  of 
sight  between  the  BS  and  SS  and  introduced  more  multipath  in  the  RF  link.  Considering 
this  and  the  rather  limited  distances  within  the  building,  rather  than  simply  using  the  data 
trend  line  illustrated  in  Figure  6  to  approximate  change  in  TA  with  distance,  the  data 
could  also  more  broadly  be  interpreted  to  represent  one  cluster  in  the  laboratory  and  one 
cluster  in  the  passageway.  This  still  indicates  very  consistent  results  at  similar  distances, 
with  greater  distances  resulting  in  greater  initial  TA. 

Finally,  the  observed  TA  were  all  negative,  which  recalling  from  the  standards,  is 
defined  to  indicate  the  SS  should  be  transmitting  sooner.  A  larger  negative  number 
indicates  the  SS  should  be  making  more  and  more  correction  to  transmit  earlier  in  time. 
For  the  sake  of  clarity,  all  remaining  discussion  of  TA  during  the  initial  ranging  will 
simply  indicate  the  magnitude  of  the  TA,  so  a  great  TA  will  reflect  greater  distance  and 
timing  advance,  avoiding  any  possible  confusion  with  larger  negatives  being  smaller. 
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B.  OBSERVATIONS  OF  TEST  DATA  FROM  SANJOLE 

In  the  process  of  optimizing  test  methodology  with  the  WaveJudge,  during  a  site 
visit  and  meeting  with  Sanjole  Chief  Technology  Officer,  Dr.  Xavier  Leleu,  several  other 
capabilities  of  the  WaveJudge  were  discussed  beyond  simply  decoding  the  traffic  from 
the  air  interface.  Sanjole  had  designed  the  WaveJudge  to  provide  diagnostic  capabilities 
to  equipment  vendors  after  witnessing  difficulties  observing  intersystem  communications 
at  PlugFest  events.  In  these  settings,  testing  with  the  WaveJudge  is  often  conducted  over 
wired  channels,  rather  than  the  air  interface  as  in  the  NPS  laboratory. 

Two  interesting  features  that  might  be  useful  in  automating  geolocation  were  also 
presented.  The  WaveJudge  has  scripting  capability,  which  would  allow  specific  parts  of 
the  decoded  WiMAX  messages  to  be  passed  to  another  program  over  a  TCP  port. 
However,  use  of  this  scripting  feature  requires  additional  licensing,  and  even  using  the 
scripting  feature,  the  WaveJudge  still  transfers  the  entire  base  band  signal  to  the  analysis 
computer,  creating  a  limited  collection  window  based  on  available  memory  and 
introducing  extra  delay  during  processing. 

Another  feature  of  WaveJudge  is  the  ability  to  range  certain  packets.  During  a 
bandwidth  request,  a  WiMAX  subscriber  transmits  one  of  64  known  PN  codes.  Just  as 
the  BS  can  range  the  SS  based  on  known  codes  during  network  entry,  the  WaveJudge  can 
find  the  range  from  its  antenna’s  location  to  the  SS  based  on  delay  in  the  reception  of  the 
PN  code  from  the  SS’s  assigned  transmission  time  seen  in  the  uplink  map. 

Observing  such  ranges  in  Sanjole’ s  data  from  wired  testing  with  the  WaveJudge 
logically  collocated  with  the  BS,  the  equivalent  TA  seen  from  the  WaveJudge  was 
consistent  with  the  BS’s  TA  in  the  RNG-RSP  with  the  exception  of  a  fixed  offset.  Leleu 
reported  that  an  offset  between  the  transmit  and  receive  channels  has  been  observed  in 
most  BSs,  causing  an  offset  value  that  the  link  is  able  to  adjust  for  during  the  ranging 
process  by  simply  adjusting  for  it  in  the  TA  [13].  This  agrees  with  and  explains  the  offset 
value  seen  in  the  initial  collection  in  the  NPS  laboratory. 

Ranging  based  on  known  PN  codes  from  a  collection  and  analysis  box,  such  as 


the  WaveJudge,  could  easily  add  a  second  location  from  which  to  establish  a  radius  to  aid 

16 


in  the  geolocation  process.  However,  while  the  initial  RNG-RSP  contains  a  MAC 
address,  responses  to  the  PN  code  are  simply  addressed  to  whichever  SS  sent  that  specific 
code  of  the  64  known  codes,  so  more  associated  traffic  would  have  to  be  stored  and 
correlated  to  specifically  associate  which  SS  was  just  ranged.  This  identification  issue 
will  have  to  be  addressed  for  periodic  ranging  cases  as  well,  since  after  a  connection 
identifier  is  established,  the  network  no  longer  references  the  MAC  address.  For  the 
duration  of  this  paper,  we  will  continue  to  focus  specifically  on  ranging  based  on  the 
RNG-RSP. 

This  chapter  began  examining  actual  collection  of  the  network  entry  process  from 
the  air  interface  and  illustrates  a  sample  of  actual  time-length-value  encoded  bits  decoded 
from  RF.  This  collection  verified  consistency  with  the  standard,  and  collection  within  the 
confines  of  the  laboratory  facilities  began  to  show  highly  consistent  values  with  linear 
correlation  to  distance.  Insights  from  the  equipment  vendor  confirmed  a  timing  offset  can 
exist  between  the  BS  send  and  receive  channels,  as  well  as  highlighting  the  potential  to 
establish  a  range  from  the  collection  platform  and  the  ability  to  use  scripts  to  pipe  timing- 
data  into  other  programs.  With  this  ability  to  rapidly  and  automatically  move  the 
decrypted  TA  to  another  program  in  mind,  the  following  chapter  explores  the 
development  of  a  user  interface  as  well  as  the  underlying  mathematics  to  calculate  a 
geolocation  based  on  this  timing  data. 
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IV.  INTERFACE  DEVELOPMENT 


A.  GUI  BACKGROUND 

In  order  to  facilitate  the  practical  use  of  the  method  of  crossing  range  radii  from 
two  or  more  BSs  or  a  BS  and  other  collection  sites  capable  of  ranging  based  on  known 
PN  codes,  automated  computation  accessed  through  a  graphic  user  interface  (GUI)  best 
enables  an  emergency  responder  or  tactical  user  without  requiring  in  depth  technical 
background  or  complicated  calculations.  The  use  of  any  automated  system  requires  user 
understanding  of  its  capabilities  and  limitations.  While  a  GUI  rapidly  presents  a  location 
approximation,  it  is  important  to  remember  that  there  is  variation  in  TA  measurements 
and  output  locations  represent  a  probable  area  and  not  certain  point.  The  approximations 
are  also  only  based  on  the  programs  internal  algorithm  and  the  user  may  have  other 
information  that  further  refines  an  accurate  location  approximation  or  refutes  an  errant 
estimate.  For  instance,  in  a  case  where  there  are  multiple  intersections  between  two 
radius  rings,  a  computer  will  be  unable  to  differentiate  them,  but  other  situational 
information  may  cue  a  user  to  favor  one  intercept  as  having  a  higher  likelihood  of  being 
the  SS’s  actual  location. 

Such  a  GUI  was  developed  in  HTML  with  JavaScript,  utilizing  the  Google  Maps 
API  to  provide  access  to  global  satellite  and  terrain  maps.  The  web  interface  allows  for 
easy  cross  platform  use  without  the  need  for  custom  hardware  or  map  databases.  The 
general  layout  of  the  GUI  consists  of  a  simple  form  to  accept  BS  and  collector  locations 
with  TA  information  before  rendering  the  plot  with  site  coordinates,  range  radius  rings, 
and  a  likely  SS  location  ellipse.  It  would  be  possible  to  populate  these  fields  from  a 
database  containing  known  BS  locations,  a  GPS  position  of  the  collector,  and  scripted  TA 
output  feeds  from  an  analysis  device  like  the  WaveJudge.  For  purposes  of  testing  and 
evaluation,  the  GUI  also  contains  fields  to  input  the  known  location  of  a  SS  so  its  true 
location  can  be  compared  to  the  output  approximation  during  trials.  While  the  details  of 
the  HTML  implementation  and  syntax  used  with  the  Google  Maps  API  are  beyond  the 
scope  of  this  paper,  the  complete  code  is  included  in  Appendix  C.  The  JavaScript  section 
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of  the  code  contains  the  mathematical  implementation  of  the  geolocation  approximation 
and  the  employed  methodology  is  examined  in  detail  below. 


B.  ENABLING  APPROXIMATIONS 

Utilizing  a  method  of  intersecting  range  radii  based  on  propagation  delay  acquired 
from  signal  internals,  a  number  of  initial  working  parameters  were  first  established.  As 
discussed  in  Chapter  II,  assuming  free  space  propagation  at  the  speed  of  light, 

O 

approximately  3x10  meters  per  second,  at  the  bandwidth  used  each  unit  of  TA  seen  from 
the  BS  increases  the  range  radius  by  75  meters.  This  provides  the  basis  for  all  range  radii 
in  the  calculations,  both  limiting  resolution  to  75  meters  in  the  best  case  scenario  and 
accepting  that  there  are  variance  and  deviation  in  measurement. 

A  further  initial  approximation  is  the  use  of  a  flat  Earth  to  facilitate  calculations 
in  Cartesian  coordinates.  While  a  flat  Earth  approximation  does  not  introduce  significant 
error  over  typical  cell  ranges,  which  are  only  infinitesimally  curved  on  the  geode,  it 
simplifies  calculations  of  range  radii,  intercepts,  and  probability  polygons  to  work  in  a 
meters-by-meters  coordinate  system.  However,  mapping  the  results  back  to  the  spherical 
system  of  latitude  and  longitude  on  Earth’s  surface  requires  a  coordinate  transformation. 

Over  the  entire  globe,  parallels  of  latitude  are  all  parallel  with  the  equator  and 
effectively  equally  spaced.  However,  meridians  of  longitude  converge  at  the  poles.  At  the 
equator,  a  degree  of  longitude  is  roughly  equal  to  a  degree  of  latitude.  However,  moving 
toward  the  poles,  the  meridians  converge  so  the  distance  per  degree  of  longitude 
diminishes  while  the  distance  per  degree  of  latitude  remains  consistent.  While  this  does 
not  affect  the  Cartesian  calculation  -  ten  meters  by  ten  meters  is  the  same  no  matter  the 
location  -  it  does  introduce  some  complication  into  mapping  the  results  calculated  on  a 
square  grid  back  to  the  surface  of  the  Earth. 

As  a  simplifying  assumption,  it  is  approximated  that  over  small  distances  the 

convergence  of  meridians  is  negligible,  so  meridians  of  longitude  are  parallel.  This  is 

analogous  to  the  far  field  approximation  generally  employed  in  radio  frequency  analysis 

that  as  the  radius  of  curvature  becomes  exceedingly  large  at  a  distance  from  the 

transmission  source  it  can  be  modeled  as  a  plane  wave.  Assuming  both  lines  of  latitude 
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and  longitude  to  be  self  parallel,  they  form  a  rectangular  grid.  The  results  of  Cartesian 
calculations  can  simply  be  mapped  from  a  square  grid  to  a  rectangular  grid  by 
multiplication  by  a  linear  constant  in  each  direction,  drastically  simplifying  in 
implementation  without  appreciable  loss  of  fidelity. 

A  degree  of  latitude  is  approximately  110  kilometers,  and  the  length  of  a  degree 
of  longitude  is  calculated  based  on  scaling  this  value  at  the  equator  by  the  cosine  of  the 
latitude,  resulting  in  equivalent  distances  at  the  equator  and  the  length  of  a  degree  of 
latitude  collapsing  to  zero  at  the  poles.  While  these  approximations  provide  very  accurate 
results  in  most  cases,  very  near  the  poles  some  anomalies  may  manifest  in  this  coordinate 
system  mapping. 

A  final  coordinate  mapping  concern  is  the  orientation  of  the  angles.  In  most  two- 
dimensional  mathematical  applications,  the  X  axis  is  horizontal  with  the  Y  axis  vertical. 
Zero  degrees  is  defined  to  be  straight  to  the  right  in  the  positive  X  direction,  while  a 
positive  90  degrees  is  counterclockwise  a  quarter  revolution,  straight  up  along  the  Y  axis. 
However,  working  on  the  globe,  it  is  customary  to  define  north  as  zero  degrees,  while  90 
degrees  is  defined  by  turning  clockwise  to  the  east.  This  requires  a  90-degree  shift  and 
then  an  axis  flip  to  overlay  the  coordinate  systems.  All  of  the  trigonometric  sine  function 
calculations  still  work  on  the  flat  Earth  projection,  but  axis  orientation  must  be  taken  into 
account  to  maintain  the  proper  reference  frame. 

C.  LIKELY  LOCATION  CALCULATIONS 

Given  two  stations,  each  with  a  known  radius,  the  most  likely  location  of  an  SS  is 
where  the  radius  rings  overlap  or  are  closest  to  overlapping.  Broadly,  three  basic 
situations  can  occur:  the  radius  circles  can  intersect,  one  radius  circle  can  be  completely 
contained  within  the  other,  or  the  two  radius  circles  can  be  separated  without  touching. 
With  only  two  stations,  overlapping  rings  results  in  two  intersections,  one  of  which  is  the 
coordinate  solution  to  the  most  likely  SS  location  based  on  those  rings.  A  third  station 
will  almost  always  remove  the  ambiguity,  since  all  three  rings  only  converge  near  one  of 
the  two  intersections  of  the  two  ring  solution.  Figure  7  illustrates  the  decision  process  as  a 
flow  chart. 
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Figure  7.  Flow  Chart  for  Geolocation  Method. 


Initially  limiting  the  number  of  range  rings  to  two,  based  on  available  test 
equipment,  the  best  possible  location  estimate  will  occur  as  the  two  intersections  get 
closer  and  closer  to  the  point  where  the  radius  circles  only  touch  in  one  point.  Given  this 
best  fix  is  achieved  with  the  radius  circles  barely  touching,  concentric  or  separated  circles 
also  provide  the  possibility  of  an  accurate  approximation  when  they  are  close  to  touching. 
Two  radius  circles  that  come  very  close  but  do  not  intersect  is  as  valuable  a  solution  as  a 
single  intersection,  but  obviously  the  further  apart  the  nonintersecting  radii  become  the 
less  and  less  meaningful  the  result. 

In  order  to  determine  which  of  the  three  basic  cases  has  occurred,  the  algorithm 
generalized  in  Figure  7  compares  the  distance  between  the  sites,  solved  by  the 
Pythagorean  Theorem  based  on  their  grid  coordinates,  to  the  sum  and  difference  of  their 
radii.  If  the  two  radii  combined  do  not  sum  to  the  total  distance  between  sites,  there  is  no 
intersection,  and  the  estimated  location  is  simply  the  midpoint  plus  an  approximation 
radius  based  on  a  scaling  factor  and  the  distance  between  the  station’s  radius  circles. 

Alternately,  if  the  distance  between  the  sites  is  less  than  the  difference  in  their 


radii,  one  radius  circle  is  completely  contained  within  the  other.  As  long  as  the  sites  are 
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not  exactly  collocated,  in  which  case  no  direction  information  can  be  ascertained, 
drawing  a  straight  line  through  the  sites  on  one  side  will  result  in  the  maximum 
separation  and  on  the  other  side  the  minimum  separation  where  the  radii  circles  are 
closest  together.  Again,  the  approximation  area  is  the  midpoint  where  they  are  closest 
together  plus  a  radius  scaled  by  a  constant  at  the  separation  distance. 

If  the  radius  circles  are  neither  self  contained  nor  completely  separate,  then  they 
intersect.  One  approach  to  find  their  intersections  would  have  been  to  iterate  through  all 
the  points  used  to  draw  the  radius  circles  on  the  map  and  find  the  ones  that  are  closest 
together  based  on  a  tolerance  for  rounding  and  the  limited  number  of  points  used  to 
approximate  a  circle.  More  accurately  and  directly  though,  the  method  used  to  find  the 
intersections  is  based  on  triangles.  The  geometry  of  this  method  is  illustrated  in  Figure  8. 

The  distance  to  the  middle  of  the  circles  overlapping  can  be  easily  determined 
from  the  law  of  cosines  based  on  the  site  radii  and  total  distance.  To  derive  this,  the 
Pythagorean  Theorem  is  simply  applied  to  both  of  the  triangles,  knowing  each 
hypotenuse  is  the  radius  and  the  base  is  the  total  distance  between  sites  less  the  distance 
from  the  midpoint  to  the  other  site.  Since  both  triangles  share  the  last  side,  solving  each 
triangle  for  this  side,  the  two  equations  can  be  set  equal  and  solved  to  find  the  distance 
from  either  site  to  the  midpoint. 


Figure  8.  Illustration  of  Geometry  to  Calculate  Circle  Intersections. 
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Both  intercepts  lie  on  a  line  perpendicular  to  the  line  between  the  sites  through 
this  midpoint.  Having  calculated  this  base  distance,  and  knowing  the  hypotenuse  of  the 
triangle  formed  from  a  site,  the  midpoint,  and  an  intersection  is  simply  the  radius  of  that 
site,  the  triangle  can  be  completely  solved  to  find  the  distance  from  the  midpoint  to  the 
intercept  that  was  eliminated  in  the  previous  derivation  when  the  equations  were  set 
equal.  Having  completely  solved  the  triangle,  the  intersection  location  relative  to  either 
the  midpoint  or  the  site  can  be  calculated,  needing  only  to  take  into  account  the 
coordinate  system  constants  so  they  plot  at  the  appropriate  latitude  and  longitude  on  the 
map. 


As  an  example,  working  in  Cartesian  coordinates  with  one  BS  at  the  origin  and 
the  other  a  distance  D  along  the  X-axis,  the  X-coordinate  of  both  intersections  is 
calculated  from  the  radii,  R,  and  inter-site  distance,  D\ 


X  = 


Rl-R^+D^ 

ID 


(2) 


The  T-coordinates  of  the  intersections  would  then  be  found  via  the  Pythagorean  Theorem 
to  be: 


While  the  likely  probability  ellipses  for  both  contained  circles  and  separate  radii 
are  simply  plotted  as  circles,  in  the  intersection  case  an  ellipse  is  drawn  around  the  two 
intersections.  In  a  case  where  the  correct  intersection  representing  the  SS  can  be 
identified,  the  probability  ellipse  can  be  viewed  as  the  area  of  overlap  from  variance-wide 
TA  bands.  This  variance  value  is  refined  in  field  testing,  but  for  initial  GUI 
implementation  with  intersection  ambiguity,  the  ellipse  is  plotted  to  contain  both 
intersections  with  the  major  axis  is  based  on  the  distance  between  the  intercepts  and  the 
minor  axis  is  based  on  the  separation  between  range  radii.  The  center  of  the  ambiguous 
two  BS  ellipse  is  the  same  midpoint  calculated  to  solve  the  intercept  positions  and  the 
relative  angle  of  the  intercepts  defines  the  tilt  of  the  ellipse  (this  is  simply  90  degrees 
from  the  angle  between  the  sites).  Separate  cases  deal  with  whether  the  intersecting 
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circles  centers  both  contained  within  the  larger  radius,  overlapping  from  within,  or 
whether  the  two  circles  overlap  from  the  outside  to  provide  the  most  reasonable 
approximation. 

D.  DISPLAYED  RESULTS 

After  the  calculations,  the  Web  interface  displays  the  map  with  both  stations 
displayed;  their  range  radius  rings,  and  the  likely  loeation  ellipse  polygon.  Mousing  over 
the  respective  icons  identifies  the  site  and  provides  its  range  radius  in  meters.  If  a  SS 
coordinate  was  entered,  it  will  also  be  displayed  and  have  its  distanee  to  the  center  of  the 
approximation  polygon  in  its  mouse  over  popup.  If  no  SS  eoordinates  are  entered,  the  SS 
defaults  to  the  oeean  at  equator  and  the  prime  meridian,  effectively  eliminating  its  display 
in  most  eases  at  useful  zoom  levels.  None  of  these  icons  display  latitude  and  longitude 
coordinates  since  it  is  already  displayed  at  the  top  of  the  web  page  and  would  only  clutter 
the  map. 

Checking  the  details  button  provides  an  alert  popup  containing  more  information 
about  the  proeessed  ealeulations  and  causes  the  map  to  also  display  the  ellipse  eenter 
point  and  the  line  connection  the  base  sites.  The  API  allows  the  Google  Map  to  eontinue 
to  behave  as  a  user  would  expect  under  these  overlays  so  a  user  ean  pan  and  zoom  the 
map,  switch  between  street  maps,  imagery,  or  terrain  maps,  and  re-eenter  the  map  by 
clicking  on  the  hand  in  the  upper  left. 

While  database  lookups  and  scripted  input  may  be  future  additions,  even  hand 
entering  observed  values  from  the  WaveJudge  provides  a  baseline  functional  tool.  The 
sample  import  button  simulates  what  might  be  able  to  be  seripted  to  import  by  populating 
fields  with  predefined  values  eontained  in  the  HTML  for  a  test  scenario  in  Monterey.  The 
user  interface,  after  a  run  with  this  simulated  import,  is  shown  in  Figure  9. 
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Figure  9.  Sample  GUI  Screen  Shot. 


Having  discussed  the  need  for  a  GUI,  this  chapter  addressed  fundamental 
mapping  issues  including  scaling  and  coordinates  transformations  to  present  data  on  the 
globe’s  grid  of  latitude  and  longitude  rather  than  simply  in  generic  two-dimensional 
Cartesian  space.  After  discussing  these  basic  issues,  the  details  of  the  actual  geolocation 
calculation  were  discussed.  There  are  three  scenarios  in  which  radii  from  two  BS  can  be 
used  to  find  a  location  approximation  dependent  on  the  distance  between  the  BS  and  the 
radii  established  by  their  TA.  In  the  case  the  radius  circles  intersect,  the  mathematics  of 
how  to  find  the  intersections  of  two  radii  was  shown.  These  simple  principles  can  be 
extended  to  greater  numbers  of  BS  further  refining  geolocational  accuracy,  but  first, 
equipped  with  a  GUI  that  can  easily  run  on  a  laptop  and  facilitate  near  real  time 
geolocation  from  a  collection  vehicle,  further  field  testing  is  conducted  to  measure  the 
distance  seen  per  unit  TA  and  variance  in  observed  TA  at  fixed  locations  over  real  world 
distances. 
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V.  FIELD  EXPERIMENTS  AND  RESULTS 


Following  basic  lab  testing  to  verify  that  the  RNG-RSP  packet  eould  be  eaptured 
and  having  created  a  preliminary  web-based  program  to  estimate  loeations  based  on  radii 
from  two  known  points,  field  testing  was  eondueted.  There  were  two  main  goals  in  field 
testing.  First,  confirm  that  the  TA  eaptured  in  the  RNG-RSP  eontinued  to  linearly 
correlate  to  distanee  between  the  BS  and  SS  over  several  samples  at  more  practical  real- 
world  distanees.  Seeond,  testing  sought  to  establish  variability  in  repeated  measurements 
at  a  fixed  point.  This  variability  in  repeated  measurements  is  erucial  in  determining  the 
accuraey  of  a  location  fix  based  on  TA,  sinee  a  high  variance  in  TA  at  a  fixed  location 
would  lead  to  a  rather  large  area  of  uncertainty  in  approximating  a  SS  location. 

A.  TESTING  LOCATION,  CONFIGURATION,  AND  PROCEDURE 

In  order  to  eonduct  testing,  the  same  Redline  WiMAX  equipment  used  in  the  lab 
was  used  to  establish  a  simple  outdoor  WiMAX  network,  eonsisting  simply  of  the  BS  and 
SS  operating  at  3.4175  GHz  configured  the  same  as  in  the  laboratory.  Since  this  WiMAX 
frequeney  is  in  the  licensed  band,  full  scale  testing  eould  not  be  eondueted  on  and  around 
the  NPS  eampus  in  Monterey,  so  instead  arrangements  were  made  to  conduet  testing  at 
Camp  Roberts,  outside  of  San  Miguel,  CA. 

The  testing  site  around  MeMillan  Airfield  at  Camp  Roberts  was  predominately 
flat  terrain  with  some  trees  and  small  single-story  buildings,  providing  primarily  line  of 
sight  conditions  during  testing.  Conditions  were  clear,  with  temperatures  approaching  35 
degrees  Celsius  at  midday.  The  only  other  signal  in  the  vieinity  of  the  WiMAX  operating 
frequeney  was  an  approximately  2-5  GHz  spread  speetrum  signal  ereating  negligible 
interferenee. 

Configuring  the  WiMAX  network  at  Camp  Roberts,  the  AN-IOOU  BS  and 
antenna  were  mounted  on  top  of  a  raised  observation  platform,  with  the  antenna  mounted 
7  meters  above  the  ground.  The  exact  same  cabling  and  settings  were  used  as  in  the  lab, 
and  the  BS  was  powered  up  and  left  alone  for  the  remainder  of  the  testing.  The  SS  was 
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attached  to  a  portable  wooden  stand  with  the  SS  antenna  at  2  meters  above  the  ground. 
Neither  the  BS  nor  SS  were  eonnected  to  other  eomputers  or  data  sources. 

Network  entry  was  faeilitated  simply  by  powering  up  the  SS,  which  began  the 
network  entry  proeess,  just  as  turning  on  a  cell  phone  negotiates  network  entry  even  if  the 
user  is  not  immediately  placing  a  call.  Powering  down  the  SS  and  powering  it  baek  up  at 
the  same  location  allowed  for  repeated  eaptures  of  the  network  entry  process  to  eapture 
multiple  RNG-RSP  messages  at  the  same  distance  from  the  BS. 

Collection  in  the  field  was  done  from  a  vehicle,  simulating  what  would 
realistically  be  done  by  emergency  response  personnel  or  tactical  operators.  Using  a  roof- 
mounted  omni-direetional  antenna,  the  WiMAX  signal  was  eaptured  from  the  air 
interfaee  by  the  WaveJudge.  Manually  clieking  to  open  the  RNG-RSP  response  packet  in 
the  WaveJudge  interface,  the  TA  was  extracted  and  reeorded.  GPS  coordinates  were  also 
manually  entered  from  the  output  of  a  basic  consumer  Garmin  nuvi  200.  More  advaneed 
scripting  may  still  allow  this  data  to  be  exported  directly  from  the  WaveJudge  and  a  GPS 
device  to  feed  a  geolocation  program  like  the  one  developed  in  the  previous  ehapter,  but 
manual  data  entry  was  still  timely  during  the  experimentation.  Figure  10  diagrams  the 
configuration  of  test  equipment.  Photographs  and  a  sample  WaveJudge  screen  capture  are 
ineluded  in  Appendix  D. 
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Figure  1 1 .  Field  Collection  Station  Locations. 


The  SS  was  set  up  at  6  different  locations  as  shown  in  Figure  11,  with  trials  run 
until  at  least  5  TA  were  successfully  collected.  One  exception  occurred  later  in  the  day  at 
the  final  range  of  greater  than  1  km  when  only  one  TA  was  successfully  captured  due  to 
equipment  difficulties.  Initial  observations  showed  very  high  consistency  between 
repeated  observations  at  fixed  distances  and  what  appeared  to  be  predictably  greater  TA 
with  increasing  distance. 

B.  NOTED  CHALLENGES  DURING  FIELD  TESTS 

Several  challenges  presented  themselves  while  working  with  the  WaveJudge  as  a 
piece  of  collection  equipment.  Sanjole  designed  the  WaveJudge  to  provide  vendor 
laboratory  analysis  to  aid  with  design  and  interoperability  testing  [13],  not  provide  real 
time  output.  As  such,  the  entire  collected  OFDM  waveform  is  shifted  to  baseband  and 
transferred  to  the  analysis  computer  for  decoding,  rather  than  being  broken  out  to  the  bit 
stream  and  sent  to  the  computer.  Because  of  this  design,  there  is  a  limited  amount  of  time 
the  system  can  capture  before  it  runs  out  of  memory.  During  field  collection  it  became 
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important  to  time  trigger  the  WaveJudge  to  cycling  power  on  the  SS,  otherwise  the  RNG- 
RSP  was  not  captured  in  the  limited  collection  window.  In  execution,  it  was  found  with 
the  tested  Redline  SU-0  SS,  triggering  collection  at  approximately  20  seconds  after  first 
applying  power  to  the  SS  fairly  reliably  captured  the  RNG-RSP  in  the  eight-second 
collection  window.  After  a  sample  was  collected  off  the  air  interface,  the  computer  still 
had  to  decode  the  base  band  signal,  which  introduced  further  delay  into  the  process. 

These  issues  do  not  discredit  the  numerical  results  or  in  any  way  devalue  the 
capabilities  of  the  WaveJudge  to  capture  RF  and  decode  protocols,  but  we  simply  point 
out  that  in  this  case  the  equipment  is  being  used  for  something  other  than  its  initially 
intended  design  purpose.  To  actually  field  an  operational  geolocation  system,  real  time 
processing  to  the  bit  stream,  as  is  done  by  the  SS  modem,  would  allow  triggering  on  the 
RNG-RSP,  allowing  capture  without  having  to  fortuitously  align  the  memory  limited 
collection  window. 

Another  issue  that  arose  in  testing  later  in  the  day  was  thermal  stress  on  the  BS. 
Initial  collection  in  clear  condition  with  minimal  interference  showed  minimal  errors  in 
any  of  the  packets  collected.  Later  in  the  day  however,  more  and  more  errors  occurred  in 
the  captured  streams,  not  only  in  the  RNG-RSP,  but  the  uplink  maps,  downlink  maps,  and 
many  other  packets  the  WaveJudge  simply  decoded  as  error  packets. 

Initially,  it  was  thought  that  the  increasing  range  may  have  had  an  effect,  although 
WiMAX  is  specified  to  operate  at  much  greater  distances,  but  using  higher  gain  antennas 
did  not  have  any  effect,  and  even  returning  to  a  distance  of  less  than  half  a  kilometer  did 
not  resolve  the  issue.  However,  by  the  end  of  the  afternoon,  temperatures  at  Camp 
Roberts  approached  36  degrees  Celsius,  and  the  BS  is  only  specified  to  operate  at  up  to 
40  degrees  [14],  so  operating  the  WiMAX  network  on  the  edge  of  specifications  began  to 
induce  errors.  If  a  temperature-controlled  space  had  been  available  for  the  BS  unit,  the 
antenna  did  not  seem  to  have  any  issues,  and  testing  could  have  continued.  However,  due 
to  limitations  of  time  and  space,  this  concluded  range  testing. 
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Noting  the  effects  of  temperature  on  the  BS,  while  our  vehicle  maintained 
functioning  temperatures  for  the  collection  suite,  thermal  stress  is  definitely  something  to 
take  into  consideration  in  designing  systems  for  fielded  operational  use. 

C.  FIELD  TEST  RESULTS 

Despite  the  noted  issues  that  arose  during  collection,  the  experimentation  was 
successful,  and  after  combing  the  results  of  the  tests  at  various  ranges,  a  continued  trend 
of  tightly  grouped  TA  with  linear  progression  corresponding  to  distance  from  the  BS  was 
observed.  The  collected  data  is  plotted  in  Figure  12  with  results  summarized  in  Table  3. 
Taking  into  account  a  basis  offset  from  the  delay  between  the  BS  transmit  and  receive 
channels  and  cabling  between  the  BS  and  BS  antenna  based  on  the  measurements  in  the 
lab,  the  results  show  an  average  meters  per  unit  of  TA  is  36.99  with  a  standard  deviation 
of3.10. 
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Figure  12.  Field  Test  RNG-RSP  TA  vs  Distance. 
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BS  Lat  Dec 

BS  Lon  Dec 

SS  Lat  Dec 

SS  Lon  Dec 

Dist  (m) 

Avg  TA 

Std  Dev 

Meters/TA 

Lab 

Lab 

Lab 

Lab 

11 

-66.7 

0.786 

Basis  Offset 

35.71574 

-120.76390 

35.71590 

-120.76525 

123.5 

-70.6 

0.548 

31.43 

35.71574 

-120.76390 

35.71658 

-120.76710 

304.5 

-75.0 

0.000 

36.55 

35.71574 

-120.76390 

35.71725 

-120.76768 

381.4 

-77.0 

0.000 

36.92 

35.71574 

-120.76390 

35.71807 

-120.76972 

586.5 

-82.4 

0.548 

37.28 

35.71574 

-120.76390 

35.71878 

-120.77182 

792.2 

-86.4 

0.894 

40.15 

35.71574 

-120.76390 

35.72418 

-120.77418 

1320.8 

-100.0 

N/A 

39.63 

Table  3.  Field  Collection  Results. 


Averaging  the  standard  deviation  in  TA  at  any  given  distance  gave  an  average 
standard  deviation  of  0.462.  To  better  establish  the  overall  variance  in  TA,  the  results  of 
all  tests  were  combined  into  a  single  probability  density  function  (PDF)  by  using  the 
median  at  any  given  distance  as  a  reference  point  as  shown  in  Figure  13.  Based  on  this 
cumulative  data,  the  overall  standard  deviation  of  TA  was  calculated  to  be  0.673. 

Overall,  this  reaffirms  the  initial  in  lab  measurements  showing  low  variance  in 
TA  as  well  as  a  linear  correlation  of  TA  to  distance.  However,  each  unit  of  TA  resulting 
in  a  radial  distance  increase  of  37  meters  is  almost  exactly  half  of  the  calculated  distance 
of  75  meters.  This  does  indicate  even  higher  resolution,  and  the  potential  for  a  more 
accurate  location  approximation,  but  introduces  an  interesting  anomaly  because  it  is  more 
accurate  in  the  case  one  knows  what  the  actual  distance  to  use  is.  Given  the  physical  layer 
dependence  of  the  definition  of  TA,  a  consistent  ability  to  calculate  it  is  essential  to 
provide  a  robust  capability  against  varied  fixed  and  mobile  WiMAX  networks. 

A  number  of  factors  could  influence  the  correlation  of  TA  to  distance.  Over  short 
distances,  the  difference  between  measured  and  calculated  TA  may  be  exacerbated  by  the 
digital  nature  of  TA.  The  BS  has  to  round  to  a  whole  unit  and  this  may  introduce  some 
error.  However,  at  longer  ranges,  such  the  1.3  kilometer  distance,  this  rounding  effect 
will  have  less  impact  on  the  reflected  meter  per  TA.  Other  sources  of  channel  delay,  such 
as  cabling,  may  also  skew  TA.  Again,  however,  all  cabling  propagation  distances  would 
have  also  been  accounted  for  in  the  initial  basis  offset  and  mitigated  at  greater  distances. 
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Finally,  there  may  be  some  degree  of  multipath  adding  additional  propagation  time 
despite  the  clear,  predominately  line  of  sight  conditions  during  testing. 

Ultimately,  since  all  of  these  TA  modifying  effects  would  be  small  and  mitigated 
over  greater  distances,  the  factor  of  two  differences  between  the  calculated  and  measured 
TA  is  most  likely  a  phenomenon  unique  to  initial  ranging.  Recalling  from  Chapter  II, 
initial  range  occurs  after  the  SS  synchronizes  to  the  received  BS  preamble.  However, 
since  the  BS  does  not  know  how  long  it  took  for  its  downlink  to  arrive  at  the  SS,  the  first 
delay  it  sees  includes  the  time  it  took  for  the  downlink  to  reach  the  SS  plus  the 
propagation  time  for  the  SS’s  initial  ranging  request  to  reach  the  BS.  The  total  round-trip 
time  takes  twice  as  long  as  the  SS  normal  uplink  to  the  BS,  essentially  decreasing  the 
meters  per  unit  TA  by  two  during  initial  range.  However,  despite  the  extra  resolution  this 
provides  during  initial  ranging,  once  the  SS  has  an  assigned  uplink  slot,  continuing 
periodic  ranging  adjustments  may  return  to  a  range  resolution  of  75  meters. 
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Figure  13.  Cummulative  TA  Probability  Distribution  from  all  Ranges. 
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This  chapter  discussed  the  details  of  field  tests  conducted  to  observe  TA  data  over 
distances  more  accurately  simulating  a  cellular  network  environment.  Having  detailed 
testing  procedures  and  challenges,  results  from  the  field  testing  showed  a  very  linear 
progression  of  TA  with  increasing  distance  along  with  a  very  low  variance  in  repeated 
measurements  at  fixed  SS  locations,  indicating  the  possibility  for  tightly  bounded 
geolocation  probability  ellipses.  The  range  resolution  during  initial  ranging  turned  out  to 
be  twice  as  good  as  initial  calculations  from  the  parameters  documented  in  the  standard 
had  suggested,  although  this  added  resolution  may  be  limited  to  the  initial  ranging 
procedure.  Having  established  a  baseline  for  the  performance  of  a  standard  compliant 
WiMAX  network  in-field  testing,  the  following  chapter  expands  the  hardware 
constrained  results  through  computer  simulation  to  provide  estimates  of  geolocation 
accuracy  in  varied  networks  with  multiple  BS. 
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VI.  MULTIPLE  BASE  STATION  SIMULATIONS 


While  field  and  laboratory  testing  were  limited  to  the  one  available  BS,  to  better 
understand  the  potential  for  geoloeating  a  SS  in  a  real  world  WiMAX  network,  several 
multiple-BS  scenarios  were  simulated  in  software.  Using  the  data  collected  from  the  BS 
in  the  field  tests  at  Camp  Roberts,  MATLAB  was  used  to  simulate  multiple  BSs  with  the 
same  mean  distance  per  unit  of  TA  of  37  meter  and  standard  deviation  of  0.673  units  TA. 
While  this  assumes  that  all  BSs  in  the  network  share  the  same  characteristics  as  the  one 
AN-IOOU  BS  used  in  testing,  it  remains  a  reasonable  premise  based  on  the  designed 
interoperability  within  the  standard. 

A.  TWO  BASE  STATION  SIMULATION 

First,  two-BS  scenarios  were  simulated  using  the  algorithm  developed  in  Chapter 
IV  to  approximate  the  location  of  a  SS  based  on  two  radii.  The  simulation  created  two 
BSs  at  varying  angles  as  observed  by  the  SS,  each  with  normally  distributed  random 
distance  with  a  mean  of  one  kilometer  from  the  SS,  standard  deviation  in  range  of  300 
meters,  and  TA  fluctuations  as  observed  through  measurement.  Since  TA  is  a  discrete 
value,  the  BS  first  rounded  distance  to  a  whole  unit  of  TA,  and  then  on  top  of  this  an 
error  factor  based  on  the  observed  variance  seen  in  measurements  was  added.  A  Monte 
Carlo  simulation  of  one  hundred  thousand  runs  were  conducted  at  each  angle  and  the 
average  distance  from  the  center  of  the  approximation  polygon  (the  midpoint  between  the 
two  circle  intersections)  to  the  actual  SS  location  over  these  many  runs  was  recorded. 

At  180  degrees,  the  two  BSs  and  SS  form  a  straight  line,  and  SS  is  location  is 

accurately  approximated  in  the  middle.  However,  as  the  angle  collapses  from  this  ideal 

geometry,  the  two  intersections  of  the  radii  get  farther  and  farther  apart,  and  since  there  is 

ambiguity  as  to  which  intersection  represents  the  location  of  the  SS,  the  location 

approximation  of  a  midpoint  between  the  intersections  becomes  farther  and  farther  from 

the  true  SS  location.  If  other  a  priori  knowledge  could  allow  an  operator  to  distinguish 

between  the  two  intersections,  one  of  the  intersections  is  always  close  to  the  SS,  but  the 

algorithm  alone  cannot  differentiate  the  two  intersections.  Interestingly,  the  estimate 
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distance  collapses  again  onee  the  angle  between  the  BS  approaches  zero,  sinee  the  BSs 
and  SS  are  again  in  a  line.  Figure  14  shows  the  overall  results  of  this  two  BS  simulation. 


2  BS  Estimate  Error  Varying  Angle 


Angle  Between  BS  (Degrees] 


Figure  14.  Distance  to  Midpoint  Between  Interseetions  with  2  BS  Varying  Angle. 


B.  MULTIPLE  BASE  STATION  SIMULATIONS 

Noting  the  limitations  of  a  two-BS  fix,  a  seeond  set  of  simulations  was  condueted 
in  MATLAB  using  multiple  BS.  Except  in  rare  cases  introdueing  a  third  BS  removes  the 
ambiguity  between  whieh  of  the  interseetions  of  the  two  BS  represented  the  approximate 
loeation  of  the  SS.  Figure  15  illustrates  the  sort  of  worst-case  seenario  that  may  occur 
with  a  three-BS  network  whieh  generates  a  very  inaecurate  loeation  approximation  by 
essentially  devolving  to  approximate  a  two-BS  network. 

The  general  approaeh  of  the  multiple-BS  simulation  algorithms  is  simply  to 
calculate  the  interseetions  of  each  pair  of  BS  radii,  and  then  for  each  pair's  intersections, 
see  whieh  is  elosest  to  the  nearest  intersection  of  the  next  pair  of  BS’s  radii.  This 
intersection  should  represent  the  intersection  nearest  the  SS,  and  is  added  to  an  array  of 
intersections.  Once  this  process  has  been  repeated  for  all  pairs,  the  array  of  elosest 
interseetions  forms  the  vertices  for  a  small  polygon  approximating  the  location  of  the  SS. 
In  the  case  of  three  BS,  there  are  six  interseetions  from  the  three  pairs;  producing  three 
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chosen  closest  intersections,  which  when  plotted  should  form  a  small  triangle  near  the 
actual  SS  location.  In  order  to  approximate  the  center  of  this  polygon  not  knowing  its 
exact  shape  or  number  of  vertices,  the  X  component  of  each  chosen  intersection  was 
averaged  to  find  the  X  coordinate  for  the  center  of  the  approximation,  and  the  process 
repeated  with  the  Y  coordinates  from  the  same  selected  intersections. 

Using  this  location-approximation  algorithm  with  varying  numbers  of  BS,  several 
BS-location  scenarios  were  tested.  First,  all  BS  were  placed  at  random  angles  from  the  SS 
with  normally  distributed  random  distances  with  a  mean  of  1 .2  kilometers  and  a  standard 
deviation  of  400  meters.  This  completely  random  placement  of  BS  was  repeated  for 
100,000  runs  at  each  number  of  BSs,  and  the  average  distance  from  the  estimate  to  SS  at 
each  number  of  BSs  was  recorded  as  in  the  earlier  two-BS  simulation. 

As  previously  noted,  an  interesting  result  of  the  completely  random  BS  placement 
was  that  sometimes  rare  geometries  would  cause  even  the  three-BS  scenario  to  produce 
an  inaccurate  result  if  the  algorithm  selected  to  weight  a  cluster  of  intersection  where  the 
SS  was  not  actually  located.  Basically,  a  three-BS  fix  can  devolve  to  the  two  radii 
ambiguity  problem  with  unfortunate  geometry  as  shown  in  Figure  15,  where  triangles 
show  towers,  diamonds  show  selected  intersections,  the  star  shows  the  algorithm’s 
estimated  location  and  the  square  shows  the  actual  SS  location. 


3  Base  Stations,  753  Meters  from  Estimate  to  Subscriber 
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Figure  15.  Inaccurate  Fix  Situation  with  3  BS. 
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Since  all  of  the  geometries  are  averaged  in  with  the  other  runs,  estimates  that  are 
hundreds  of  meters  off  weigh  in  with  many  very  aceurate  estimates  from  a  three-BS 
geolocation,  as  reflected  in  the  results  shown  in  Figure  16.  Given  that  the  overall  average 
error  between  the  approximated  eenter  point  and  the  SS  is  still  only  80  m,  there  are  many 
more  accurate  fixes  than  the  outlier  cases  (sueh  as  Figure  15)  that  pull  up  the  average. 
Appendix  E  contains  more  sample  plots  from  the  multiple-BS  runs,  including  a 
successful  three-BS  run  that  aceurately  estimates  the  SS  location. 

In  a  real  world  network,  BS  loeations  ean  be  antieipated  to  be  more  logically 
distributed.  While  aetual  tower  loeations  in  modem  cellular  networks  rarely  align  exactly 
to  the  idealized  honeycomb  cell  layout,  they  are  generally  spaced  to  provide  maximum 
coverage  with  the  least  number  of  towers  dependent  on  subscriber  density.  As  sueh,  two 
follow-on  multiple  BS  simulations  were  mn  that  added  some  straeture  to  the  BS 
placement.  First,  the  angles  were  fixed  to  be  evenly  spaced  based  on  the  number  of 
towers  while  distanees  were  randomly  assigned  as  in  the  initial  multiple-BS  simulation, 
and  then  for  even  further  stmeture,  the  same  even  angle  distribution  was  used  but  with  all 
BS  at  a  one  kilometer  range  from  the  SS.  Figure  16  shows  these  results,  which  show 
greater  loeation  accuraey  than  the  eompletely  random  case.  In  networks  with  more 
stmctured  BS  spaeing  the  error  estimate,  despite  TA  rounding  and  variations,  is  still  less 
than  30  meters  in  all  eases. 


Estimate  Error  with  Multiple  BS 


Average  Distanee  from  Estimate  to  SS  with  Multiple  BS. 
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Figure  16. 


Based  on  these  results,  real-world  scenarios  can  be  expected  to  fall  somewhere 
between  ideal  and  completely  random  geometries,  so  a  geolocation  fix  assuming  the 
parameters  measured  in  field  testing  can  on  average  be  expected  to  fall  within  50  meters. 
Appendix  E  contains  sample  plots  generated  during  these  different  multiple-BS 
simulations,  and  in  many  of  these  cases,  the  fix  is  well  within  20  meters. 

Having  noted  the  discrepancy  between  the  37-meter  average  distance  per  unit  TA 
observed  in  initial  ranging  and  the  generalized  calculated  value  of  75  meters  per  TA,  the 
simulations  were  re-run  using  75  m  as  a  basis  instead.  By  increasing  the  distance  between 
differentiable  radii,  the  resolution  is  reduced  and  the  effect  of  rounding  error  is  increased. 
Figure  17  compares  the  results  of  the  simulation  using  37  and  75  meters  per  TA. 
Interestingly,  the  geolocation  accuracy  of  an  ideal-geometry  networks  with  75  meter  TA 
units  is  nearly  identical  to  that  of  a  suboptimal  geometry  in  a  network  with  37  m  per  unit 
ofTA. 

As  one  would  anticipate,  the  reduced  resolution  and  greater  rounding  error  leads 
to  somewhat  larger  approximation  errors.  None-the-less,  expecting  real-world  BS 
configurations  to  be  between  very  structured  and  completely  random,  it  is  reasonable  to 
expect  an  average  distance  from  the  approximation  center  point  to  the  subscriber  to  be 
within  100  meters. 

As  an  alternate  presentation  of  this  data,  rather  than  using  average  distance  from 
the  SS  to  estimated  location  over  100,000  trails,  the  same  scenarios  can  be  accessed  via 
circular  error  probable  (CEP),  that  is  the  radius  within  which  50  percent  of  the  samples 
lie.  The  CEP  for  various  numbers  of  BSs,  with  both  BS  geometry  configurations  and 
distances  per  unit  TA  as  before  are  shown  in  Figure  18.  The  same  trends  are  seen  as  when 
viewing  the  averages,  but  the  circle  containing  50  percent  of  the  estimates  has  a  smaller 
radius  than  the  average  distance  to  the  estimates  calculated. 
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Estimate  Error  with  Varied  m/TA 


Using  CEP,  as  before  with  averages,  it  is  safe  to  assume  that  in  more  than  50 
pereent  of  eases,  a  SS  ean  be  geolocated  within  50  meters  assuming  that  aecurate  BS 
loeations  are  known. 


CEP  for  Varied  Number  of  BS  and  m/TA 


Figure  18.  Cireular  Error  Probable  from  Multiple  BS  Simulations. 


40 


This  chapter  leveraged  the  collected  real  world  data  from  field  testing  of  a 
WiMAX  network  and  expanded  it  using  computer  simulation.  Monte  Carlo  simulation 
found  that  using  average  distanee  from  approximation  center  point  to  SS  location  or  CEP 
as  a  metric,  SS  can  consistently  be  located  to  within  the  distanee  per  unit  TA,  less  than  50 
meters  during  initial  ranging.  Noting  the  TA  anomaly  in  initial  range,  simulation  results 
showed  exeellent  results  for  geolocation  based  on  the  standards  explored  in  Chapter  II, 
the  methods  explored  in  Chapter  IV,  and  the  RF  eollection  samples  documented  in 
Chapters  III  and  V. 
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VII.  CONCLUSIONS  AND  RECOMMENDATIONS 


A.  CONCLUSIONS 

Both  laboratory  and  field  testing  indicate  a  high  linear  correlation  to  distance  with 
low  variance  in  the  TA  observed  in  the  initial  ranging  RNG-RSP  message.  Based  on  this 
result,  it  is  possible  to  establish  a  range  radius  from  the  BS.  Using  multiple  range  radii 
from  several  BSs,  or  other  devices  capable  of  ranging  the  known  WiMAX  PN  codes, 
crossing  radii  can  establish  very  accurate  locations. 

Results  of  simulation  consistently  showed  that  given  the  high  resolution  of  TA 
subdivisions  within  the  signed  32-bit  value  and  low  variance  at  fixed  distances, 
geolocation  should  consistently  be  practical  within  a  50-meter  CEP  dependant  on 
accurate  knowledge  of  TA  offsets  and  values  and  BS  tower  locations.  At  the  same  time, 
while  high  range  resolution  and  low  variance  are  extremely  promising,  the  stipulations  of 
knowledge  of  TA  anomalies  and  tower  locations  are  non-trivial  and  important  to  consider 
in  fielding  a  geolocation  system. 

Having  accurate  BS  locations  to  begin  calculations  is  important,  because  any  error 
in  tower  location  will  be  reflected  in  offsetting  all  intersections  based  on  that  BS. 
Assuming  BS  locations  to  be  known  and  cataloged  in  a  database,  it  may  be  possible  to 
add  a  known  initial  TA  offset  from  differences  in  transmit  and  receive  channels,  cabling, 
and  other  site  unique  delays,  but  this  too  would  necessitate  site  surveys,  probably  beyond 
the  level  of  detail  typically  conducted  by  a  cellular  network  provider. 

Also,  while  observed  initial  ranging  showed  TA  radius  rings  with  twice  the 
resolution  calculated  based  on  Equation  1  in  Chapter  II,  the  round  trip  delay  phenomenon 
may  not  appear  when  extrapolating  these  results  to  other  periodic  ranging  occurrences 
during  continued  network  operation  after  initial  entry.  The  fundamental  methods  and 
principles  to  extract  geolocation  from  TA  data  would  remain  the  same,  but  using  the 
correct  distance  per  unit  TA  is  essential  to  correct  geolocation. 
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With  these  practicalities  in  mind,  the  results  of  testing  and  simulation  remain 
extremely  promising.  The  interoperability  standards  established  by  the  WiMAX  forum 
provide  that,  taking  due  diligence,  these  results  should  easily  extend  to  other  vendor’s 
equipment  and  the  near  verbatim  replication  of  verbiage  in  the  802.16d-2004  and  802. 16e 
standards  suggests  easy  adaption  of  this  methodology  to  mobile  WiMAX  taking  into 
account  adjustments  to  physical  layer  dependent  parameters.  Furthermore,  WiMAX’s 
chief  competitor  for  4G  cellular.  Long  Term  Evolution  (LTE),  also  operates  in  a  very 
similar  manner,  featuring  FDD  and  TDD  profiles,  of  which  the  TDD  internals  could 
similarly  be  used  to  geolocate  just  as  explored  here  for  WiMAX  networks. 

Using  the  principles  explored  through  testing  and  simulation,  it  is  possible  to 
geolocate  a  WiMAX  SS  within  approximately  50  meters,  offering  potentially  10  times 
better  location  accuracy  than  the  GSM  methods  previously  explored  in  literature,  and 
providing  a  great  capability  to  be  further  developed  and  explored  for  use  both  by 
emergency  response  personnel  and  tactical  users. 

B.  RECOMMENDATIONS 

Future  research  should  confirm  the  application  of  these  findings  to  mobile 
WiMAX  networks  and  further  investigating  periodic  ranging  and  other  opportunities  to 
extract  geolocation  data  from  WiMAX  signal  internals.  Collection  and  fixes  based  on 
actual  multi-BS  networks,  rather  than  simulation  alone,  should  be  conducted  to  verify  and 
solidify  the  results  in  this  thesis.  Actual  collection  in  real-world  multi-tower  networks 
will  also  motivate  the  issue  of  identifying  and  caching  unique  identifiers  for  different 
towers  and  subscribers  to  properly  associate  traffic  to  its  originator,  which  would  be  of 
critical  importance  to  a  fieldable  system.  Related  work  may  also  apply  these  methods  to 
LTE  wireless  device,  requiring  an  investigation  of  the  LTE  standards  before  applying  the 
techniques  illustrated  in  this  thesis  applied  to  WiMAX. 
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APPENDIX  I.  WIMAX  CERTIFICATION  PROFILES 


Band 

Index 

Frequency 

Band 

Channel 

Bandwidth 

OFDM 
FFT  Size 

Duplexing 

Notes 

Fixed  WiMAX  Profiles 

3.5MHz 

256 

FDD 

Products  already  certified 

1 

3  5  GHz 

3.5MHz 

256 

TDD 

7MHz 

256 

FDD 

7MHz 

256 

TDD 

-) 

5.8GHz 

lOMHz 

256 

TDD 

Mobile  WiMAX  Profiles 

5MHz 

512 

TDD 

Both  bandwidths  must  be  sup- 

1 

2.3GHz-2.4GHz 

lOMHz 

1,024 

TDD 

ported  by  mobile  station  (MS) 

8,75MHz 

1,024 

TDD 

2.305GHz- 

2.320GHz, 

2.345GHz- 

2.360GHz 

3.5MHz 

512 

TDD 

2 

5MHz 

512 

TDD 

lOMHz 

1,024 

TDD 

3 

2.496GHz- 

5MHz 

512 

TDD 

Both  bandwidths  must  be  sup- 

2.69GHz 

lOMHz 

1,024 

TDD 

ported  by  mobile  station  (MS) 

5MHz 

512 

TDD 

4 

3.3GHz-3.4GHz 

7MHz 

1,024 

TDD 

lOMHz 

1,024 

TDD 

3.4GHz-3.8GHz. 

5MHz 

512 

TDD 

5 

3.4GHz-3.6GHz, 

7MHz 

1,024 

TDD 

3.6GHZ-3.8GHZ 

lOMHz 

1,024 

TDD 

Table  4.  Fixed  and  Mobile  WiMAX  Certification  Profiles  (From  [10]). 
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APPENDIX  II.  802.I6D-2004  OFDM  SYMBOL  PARAMETERS 


Parameter 

\  alue 

256 

led 

200 

Jl 

For  clLTonel  bandwidths  that  tire  a 
multiple  of  1 .75  MHz  then  w  =  8./7 
else  for  channel  bandmdths  that  are  a 
multiple  of  1 .5  MHz  then  w  =  86/75 
else  for  channel  bandmdths  that  are  a 
multiple  of  1 .25  IvIHz  then  =  144.'' 125 
else  for  channel  bandw'idths  that  are  a 
multiple  of  2.75  l^lHz  then  m  =  3 16.-'275 
else  for  channel  banduidths  that  are  a 
multiple  of  2.0  MHz  then  n  =  57/50 
else  for  channel  bandmdths  not 
othen^ise  specified  then  n  =  &7 

G 

1/4,  IfS,  1/16, 1/32 

Nimiber  of  lower  frequency  guard  sut)carrier& 

28 

Number  of  higher  fiequeocy  guard  subcafiiers 

27 

Frequenc^^  offset  indices  of  guard  subcairiefi. 

-128-127....-101 

-10L,+102,...a27 

Frequency  offset  indices  of  pilot  cairiers 

-88.-63.-3  8.-1 3, 13,38, 63 ,88 

Sttbcliarmel  Index: 

[  ObOOOOl: 

i  ObOOOlO; 

/ObOOlOO-  ■  ObOOOll: 

(  1  r  ObOOlOl: 

1  ^  ObOOllO:  1 

/  ObOlOOO:  /  1  ObOOlll: 

J  |-  ObOlOOl: 

(  /  ObOlOlO; 

1  'ObOllOO-  !  ^  ObOlOll: 

1  [  ObOlIOl: 

^  ObOlllO; 

OblOQOO:  (  1  ObOllll: 

\  [  OblOOOl: 

/  Obi 00 10: 

‘  1  OblOOll: 

/OblOlOO.  OblOlOl: 

^  OblOllO: 

\  ObllOOO-  (  ■ 

1  f  ObllOOl: 

i  Obi 1010: 

Uiiioo-  1  I- 

I  OblllOl: 

^  Obi  1110: 

'■  Oblllll: 

Allocated  Frequency  offeet  indices  of 
subcarriers: 

{-100:-98.-37:-35.  1:3.  64:66} 

{-38} 

{ -97:-?5,  -34:-32. 4:6, 67:69} 

{-94:-92.  -31::-29,  7:9.  70:72} 

{13} 

{-^1:-S9.  -2S:-26,  10:12,  73:75} 

{-87:-85. -50:^8.  14:16.  51:53} 

{-88} 

{-84,-82,  ^7:^5, 17:  19.  54:56} 

{-81:-79.  ^:-42,  20:22.  57:59} 

{^53} 

{_78:_76.  ^l;_39.  23:25.  60:62} 

{-75:-73.  -12:-10.  26:28,  89:91} 

{-13} 

{-72:-70.  -9:  -7, 29:3 1. 92:94} 

{-69:^7.  -6:  -4. 32:34, 95:97} 

{38} 

{-66:-64.  -3:  -1, 35:37, 98:100} 

{_^2:^0.  -25:-23.  39:41.  76:78} 

{-^3} 

{-59:-57.  -2.2:-20, 42:44.  79:81} 

{_5(S:_54.  _1P:_17. 45:47.  82:84} 

{88} 

{-53:-51.  -16:-14. 48:50.  85:87} 

Note  that  pilot  subcaEiiers  are  allocated 
only  if  bA^o  or  more  subchannels  are 
allocated. 

Table  5.  OFDM  Symbol  Parameters  (From  [12]). 
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APPENDIX  III.  GUI  HTML/JAVASCRIPT  CODE 


<html> 

<!--  LT  D.  E.  Barber,  NFS  GSEAS  --> 

<!--  WiMAX  Geolocation  Web  Interface  --> 

<!--  Current  Revision  9.11b,  11  November  2009  --> 

<head> 

<title>  OWL  (v9.11b)  </title> 

<script 

src="http : //maps . google . com/maps?file=api&amp; v=2&amp; sensor=f alse&amp; k 
ey=ABQIAAAAKg2XhyFKbQwX6KYN9UFtGBRzqH3tuoONQrJcOYfxh_5EF- 
rAQBSuBt6V6Vzrd3cmnuVAjYdEHr3ImQ" 
type=" text/ j  avascript "></script> 

</head> 


<!--  Displayed  Header  --> 

<body  style="background-color : D3D3D3"  onunload="GUnload ( ) "> 

<noscript>Browser  does  not  have  JavaScript  enabled ! </noscript> 

<img  src=" images/npslogo . png"  alt="NPS  Logo"  align=" lef t "> 

<img  src=" images/nightowl . png"  alt="Hedwig"  align="right "> 

<hl  style=" text-align : center "><i>0</i>FDM  <i>W</i>ireless 
<i>L</i>ocator  </hl> 

<p  align="center ">  <i>Version  9 . llb</i><br/> 

TA  is  set  for  <i>BW</i>=  3.5  MHz.  Please  enter  latitude/longitude 
in  decimal  degrees  (<a 

href="http : / /www. fee . gov/mb/ audio/bickel/DDDMMSS-decimal .html/" 
target="_blank">converter</a>) . </p> 


<!--  Table  of  Fields  to  Recieve  Input  --> 

<form  name=" inputForm"> 

<table  align="center "  summary="Data  entry  fields. ">  <tr> 

<td><b>SITE  1  (Base  Station) </b></td> 

<td>Lat : </td><td>  <input  type="text"  name="SlLAT" /></td> 

<td>Lng : </td><td>  <input  type="text"  name="SlLNG" /></td> 

<td></td> 

<td>Of f set : </td><td>  <input  type="text"  maxlength=" 10 "  name="S10FF" /> 
</td> 

<td>TA : </td><td>  <input  type="text"  maxlength=" 10 "  name="SlTA" /></td> 
</tr><tr> 

<td><b>SITE  2  (Collector) </b></td> 

<td>Lat : </td><td>  <input  type="text"  name="S2LAT" /></td> 

<td>Lng : </td><td>  <input  type="text"  name="S2LNG" /></td> 

<td></td>  <td></td>  <td></td> 

<td>TA : </td><td><input  type="text"  maxlength=" 10 "  name="S2TA" /></td> 
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</ tr><tr> 


<td><b>MARK  (Subscriber) </b></td> 

<td>Lat : </td><td>  <input  type="text"  name="MLAT" /></td> 

<td>Lng : </td><td>  <input  type="text"  name="MLNG" /></td> 

<td></td>  <td></td> 

<!--  Button  to  Populate  Required  Fields  --> 

<td><input  type="button"  value=" Import "  onClick=" 

SlLAT.value='36.5986' ; 

SILNG. valuer' -121 . 87  69  '  ; 

SIOFF. valuer' 67 ' ; 

S2LAT.value='36.5909' ; 

S2LNG. valuer' -121 . 8624 ' ; 

SITA. valuer' 82 ' ; 

S2TA. valuer' 7 '  ; 

MLAT.value='3  6.5  94  9'  ; 

MLNG. valuer' -121 . 8  651 '  ;  "> 

</td> 

<!--  Future  Base  Station  Information  Import  via  Table  Lookup  --> 

<!--  Future  Collection  Location  Import  from  GPS  Feed  --> 

<!--  Future  TA  Import  from  TCP  Script  --> 

<td>  </td> 

<!--  Button  to  Execute,  Toogle  for  Detail  Alert  --> 

<td><input  type="button"  value=" &nbsp; &nbsp;  Plot  &nbsp; &nbsp; " 
onClick="doit ( ) ">  &nbsp; &nbsp; &nbsp; &nbsp;  Details : <input  type=checkbox 
name= "alert Check" > 

</td> 

</tr></table>  </form> 


<!--  Javacript  Calculation  &  Plotting  --> 

<script  type=" text/ j avascript "> 

<!-- 


function  doit()  { 

I  -k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k 

Parameters  &  Values 

kkkkkkkkkkkkkkkkkkkkkk J 

II  Start  Time 

var  startTime  =  new  Date() 
//  Constants 
pi  =  Math. PI; 
c  =  299792458; 

Fs  =  4000000; 
mTA  =  c  /  Fs; 
mLat  =  111131.75; 

//  Meters  Per  Degree 


//  Set  Value  of  Pi 
//  Speed  of  Propagation  (m/s) 

//  Sampling  Frequency  (PHY  Dependent) 

//  Meter  per  unit  TA 

//  Meters  per  Degree  Latitude  (Approx  Const) 
Longitude  Based  on  Site  Latitude 
latRad  =  inputForm.  SILAT  .  value’^pi/lSO  ; 

mLng  =  (111412 . 84’^Math  .  cos  (latRad)  )- (93 . 5’^Math  .  cos  (S’^latRad)  )  + 

( 0 . 118’^Math  .  cos  ( 5 ’^latRad)  )  ; 
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//  Number  of  Points  to  Use  in  Circle  Approximation 
npts  =  40; 

//  Distribution  Weighting  for  Probability  Ellipse 
eProbDist  =  1.2; 

//  Site  Locations  from  Form 

sllat  =  inputForm . SILAT . value ; 
sling  =  inputForm . SILNG . value ; 
s21at  =  inputForm . S2LAT . value ; 
s21ng  =  inputForm . S2LNG .value; 


j  -k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k 

Range  Radius  Calculations 

kkkkkkkkkkkkkkkkkkkkkkkkkkkk / 

//  Calculate  Circles  Radii 
//  Site  1 

slta  =  inputForm . SITA . value  -  inputForm . SIOFF . value ; 
sir  =  slta  mTA;  //  Site  1  Range  Radius  in  meters 

slrLat  =  sir  /  mLat;  //  Latitude  Variance  from  Radius 

slrLng  =  sir  /  mLng;  //  Longitude  Variance  from  Radius 

//Site  2 

s2r  =  inputForm .  S2TA .  value  mTA; 

s2rLat  =  s2r  /  mLat;  //  Lat/Lng  Delta  from  Radius 
s2rLng  =  s2r  /  mLng; 

//  Invalid  Timing  Adjust  Input  Warning 
if (slta<0 I  I inputForm . S2TA . value<0 )  { 

alert ("Input  Error:  Net  Negative  Timing  Adjust");} 

//  Create  Circle  Arrays 
var  slcLat=new  Array (); 
var  slcLng=new  Array (); 
var  s2cLat=new  Array (); 
var  s2cLng=new  Array (); 


//  Create  Arrays  to  Hold  Gmap  Lat/Lng 
var  slGlatlng=new  Array (); 
var  s2Glatlng=new  Array () ; 

//  Loop  to  Populate  Radii  Lat/Lng  Arrays 
for (var  1=0;  i<=  npts;  i++) 

{ 

angle=i’^2 ’^pi/npts ;  //Angle  in  Radians 

cosangle  =  Math . cos (angle) ;  //Math  Function  for  Cosines 
sinangle  =  Math . sin (angle); 


//  Calculate  Circles  in  Rectangular  Coordinates 
I xl  Forces  Addition  vice  String  Concatenation 
slcLat  [  i  ]  =sllat  +  (slrLat  cosangle); 

slcLng  [  i  ]  =sllng  +  (slrLng  sinangle); 

s2cLat  [  i  ]  =s21at  +  (s2rLat  ^  cosangle); 

s2cLng  [  i  ]  =s21ng  +  (s2rLng  sinangle); 
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//  Create  Gmaps  Coordinate  Arrays 

si dating [ i ] =new  GLatLng ( slcLat [ 1 ]  ,  slcLng [ i ]  )  ; 

s2Glatlng [ i ] =new  GLatLng ( s2cLat [ 1 ] , s2cLng [ i ] ) ; 

} 

High  Probability  Polygon  Approximation 

'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k'k^ 

II  Inter  Site  Distance  via  Pythag 
deltaLat=  (s21at-sllat )  ’^mLat; 
deltaLng=  (s21ng-sllng)  ’^mLng; 

dist=Math  .  sqrt  (deltaLat’^deltaLat+deltaLng’^deltaLng)  ; 

//  Angle  Set  to  0  =  North 

phi=Math . atan2 (deltaLng, deltaLat ) ; 
cosphi=Math . cos (phi) ; 
sinphi=Math . sin (phi ) ; 

bearSltoS2=Math  .  round  (phi'^lSO/pi)  ;  //Displayed  Output  Only 
if  (bearSltoS2<0 ) { 

bearSltoS2=bearSltoS2  +  360;  } 


//  Calculate  Intersection 
if (dist>slr+s2r ) { 

methodAlert="Seperated  Radii" ; 
deltaR=dist-slr-s2r ; 

mpLat=sllat’^l  +  cosphi’^  (slr+0 . 5’^deltaR)  /mLat; 
mpLng=sllng’^l  +  sinphi’^  (slr+0 . 5’^deltaR)  /mLng; 
maj  or=deltaR’^eProbDist  ; 
minor=ma j  or ; 
psi=0 ; 

} 

else  if (dist<Math . abs (slr-s2r ) ) { 
methodAlert="Contained  Circles" ; 
if  (slr>s2r)  { 

deltaR=slr-s2r-dist ; 

mpLat=sllat’^l  +  cosphi’^  (slr-0 . 5’^deltaR)  /mLat; 
mpLng=sllng’^l  +  sinphi’^  (slr-0  .  S’^deltaR)  /mLng; 

} 

else  { 

deltaR=s2r-slr-dist ; 

mpLat=sllat’^l  +  cosphi’^  (-slr-0 . 5’^deltaR)  /mLat; 
mpLng=sllng’^l  +  sinphi’^  (-slr-0  .  S’^deltaR)  /mLng; 

} 

maj  or=deltaR’^eProbDist  ; 
minor=ma j  or ; 
psi=0  ; 

} 

else  { 

me thodAlert=" Intercepts" ; 

//  Distance  from  Site  1  to  Midpoint 
slmp=  ( slr’^slr-s2r’^s2r+dist’^dist )  /  (2’^dist)  ; 

//  Distance  from  Midpoint  to  Intersection 
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mp2i=Math  .  sqrt  ( sir ’^slr- simp simp)  ; 

//  Midpoint  Coordinates 
mpLat=sllat’^l  +  slmp’^  ( s21at-sllat )  /dist; 
mpLng=sllng'^l  +  slmp'^  ( s21ng-sllng)  /dist; 

//  Intersection  Coordinates 

I Note  Final  Coordinate  Transform  Constants  / 
intlLat=mpLat’^l+mp2i’^  ( s21ng-sllng)  /disf^  (mLng/mLat)  ; 
intlLng=mpLng’^l-mp2i’^  (s21at-sllat )  /disf^  (mLat/mLng)  ; 
int2Lat=mpLat’^l-mp2i’^  (s21ng-sllng)  /disf^  (mLng/mLat)  ; 
int2Lng=mpLng’^l+mp2i’^  (s21at-sllat )  /disf^  (mLat/mLng)  ; 

//  Angle  Between  Intercepts  is  Pi/2  from  Intersite  Angie 
psi=phi+ (pi/2) ; 

//  Define  Ellipse  Axis  Lengths 

//  Adjust  Midpoint  if  Both  Foci  within  One  Radius 
if  (dist>slr&&dist>s2r )  { 
minor=  (slr+s2r-dist )  ’^eProbDist; 

} 

else  if  (s2r<slr) { 
minor=  (dist+s2r-slr )  ’^eProbDist; 
mpLat=slIat’^l  +  cosphi’^slr/mLat  ; 
mpLng=slIng’^l+sinphi’^slr/mLng; 

} 

else  { 

minor=  (dist+slr-s2r )  ’^eProbDist; 
mpLat=s2Iat’^l-cosphi’^s2r/mLat  ; 
mpLng=s2Ing’^l-sinphi’^s2r/mLng; 

} 

major=  (minor+mp2i)  ’^eProbDist; 

} 


//  Calculate  Probability  Ellipse  Bounds 

//  Create  Ellipse  Arrays 
var  peLat=new  Array (); 
var  peLng=new  Array () ; 
var  peGIatIng=new  ArrayO; 

cospsi=Math . cos (psi) ;  //  Angie  Parameters  of  Ellipse 

sinpsi=Math . sin (psi ) ;  //  Constant  So  Outside  Loop 

haIfnpts=npts/2 ;  //  Use  1/2  Number  Points  in  Circle  for  Ellipse 

for(k=0;  k<=halfnpts;  k++) { 

beta=k’^4’^pi/npts ;  //Parametric  Angle  in  Radians 

cosbeta=Math . cos (beta) ; 
sinbeta=Math . sin (beta) ; 

//  Ellipse  Defined  in  Rectangular  Coordinates 
peLat  [ k]  ^mpLaf^l  +  (ma j or’^cosbeta’^cospsi  - 
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minor’^sinbeta’^sinpsi )  /mLat; 
peLng  [ k]  =mpLng’^l+  (ma j  or’^cosbeta’^sinpsi  + 
minor'^sinbeta'^cospsi )  /mLng; 

//  Create  Gmaps  Coordinate  Array 

peGlatlng [ k] =new  GLatLng (peLat [ k] , peLng [ k] ) ; 

} 

//  Distance  from  Ellipse  Center  to  Marker  via  Pythag 
cmLat=  (mpLat- input  Fo  rm .  MLAT  .value)  ’^mLat; 
cmLng=  (mpLng-inputForm.  MLNG  .value)  ’^mLng; 
cmdist=Math  .  sqrt  (cmLat’^cmLat+cmLng’^cmLng)  ; 

I  -k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k-k 

Output  and  Display 

kkkkkkkkkkkkkkkkkkkkk j 

II  Map  Initialization  Function 
if  (GBrowserlsCompatible ( ) )  { 

var  map  =  new  GMap2 (document . getElementByld ( "map_canvas ") ) 

map . setMapType (G_PHYSICAL_MAP) ; 

map . setCenter (new  GLatLng (inputForm. SILAT .value, 

InputForm. SILNG . value)  ,  14); 
map . setUIToDef ault ( )  ; 

//  Site  Radius  Circles 

var  slcircle  =  new  GPolyline(slGlatlng,"#ff00ff",5); 
map . addOverlay (slcircle) ; 

var  s2circle  =  new  GPolyline(s2Glatlng,"#0000ff",5); 
map . addOverlay ( s2circle)  ; 

//  Probability  Ellipse 

var  probell  =  new  GPolygon(peGlatlng,"#f33f00",5,l,"ff0000",0.33); 
map . addOverlay (probell) ; 

//  Marker  for  Subscriber  Location  if  Known 

! Null  Input  Defaults  to  Equator  at  Prime  Meridan  ! 
var  mark  =  new  GLatLng (inputForm. MLAT .value, 
inputForm. MLNG. value) ; 
var  iconSS  =  new  GIcon(); 

iconSS. image  =  " images/redSS . png" ; 
iconSS . shadow  =  " images/shadow . png" ; 
iconSS . iconSize  =  new  GSize(32,  37); 
iconSS . shadowSize  =  new  GSize(51,  37); 
iconSS . IconAnchor  =  new  GPoint(16,  37); 

SStitle  =  "Subscriber  Station  \rDist  to  CP:  "  + 

Math . round (cmdist)  +  "  m" ; 
map . addOverlay (new  GMarker (mark, { icon : iconSS, 
title : SStitle } ) ) ; 

//  Rounded  Site  Radii  for  Display 
slrR=Math . round ( sir ) ; 
s2rR=Math . round ( s2r)  ; 
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//  Markers  for  Site  Locations 

var  sitel  =  new  GLatLng (sllat,  sling)  ; 
var  iconBSpink  =  new  GIcon(); 

iconBSpink . image  =  " images/pinkBS . png" ; 
iconBSpink . shadow  =  " images/BSshadow . png" ; 
iconBSpink . iconSize  =  new  GSize(22,  32); 
iconBSpink . shadowSize  =  new  GSize(39,  32); 
iconBSpink . iconAnchor  =  new  GPoint(ll,  16); 
BSltitle  =  "Base  Station  (SI)  \rRadius:  "  +  slrR  + 
"  m\rS2  Bearing:  "  +  bearSltoS2; 
map . addOverlay (new  GMarker (sitel , { icon : iconBSpink, 
title : BSltitle } )  )  ; 

var  site2  =  new  GLatLng ( s21at , s21ng) ; 
var  iconBSblue  =  new  GIcon(); 

iconBSblue . image  =  " images/blueBS . png" ; 
iconBSblue . shadow  =  " images/BSshadow . png" ; 
iconBSblue . iconSize  =  new  GSize(22,  32); 
iconBSblue . shadowSize  =  new  GSize(39,  32); 
iconBSblue . iconAnchor  =  new  GPoint (11, 16) ; 

BS2title  =  "Site  2\rRadius:  "  +  s2rR  +  "  m" ; 
map . addOverlay (new  GMarker ( site2 , { icon : iconBSblue, 
title : BS2title } )  )  ; 


//  Detail  Alert  Message 

if  ( inputForm . alertCheck . checked) { 

//  Straight  Line  Between  Sites 
var  centerLine  =  new  GPolyline  (  [ 
new  GLatLng (sllat, sling) , 
new  GLatLng ( s21at, s21ng) 

] , "#ffff00",5) ; 
map . addOverlay (centerLine)  ; 

mpLatR=Math . round (mpLaf^lOOOO ) /lOOOO  ; 
mpLngR=Math  .  round  (mpLng’^  1 0000)  /  lOOOO; 

//  Mark  Center  Point  of  Approximation  Ellipse 
var  MPmark  =  new  GLatLng (mpLat, mpLng) ; 

CPtitle  =  "Ellipse  Center  Point\rLat:  " 

+  mpLatR  +  "\rLng:  "  +  mpLngR; 
map . addOverlay (new  GMarker (MPmark, { title : CPtitle } ) ) ; 


var  endTime  =  new  Date ( ) ; 
alert  ( 

"Time  to  Execute  Script:  " 

+  (endTime . getTime ( )  -  startTime . getTime ( ) )  +  "  ms  "  + 
"\rPoints  Utilized  in  Radius  Circles:  "  +  npts  +  "  "  + 
"\rCorrected  Site  1  TA:  "  +  slta  +  "  1/Fs  "  + 

"\rMeters  per  Degree  Longitude:  "  +  Math . round (mLng)  +  "  "  + 
" \r\rDistance  Between  Sites:  "  +  Math . round (dist)  +  "  m  "  + 
"\rBearing  from  Site  1  to  Site  2:  "  +  bearSltoS2  +  "  "  + 
"\rSite  1  Radius:  "  +  slrR  +  "  m  "  + 
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"\rSite  2  Radius:  "  +  s2rR  +  "  m  "  + 

" \r\rMethod  Used:  "  +  methodAlert  +  "  "  + 

II \r\rEllipse  Midpoint  Lat :  "  +  mpLatR  +  "  "  + 

"\rEllipse  Midpoint  Lng:  "  +  mpLngR  +  "  "  + 
n \r\rDistance  from  Midpoint  to  Marker:  " 

+  Math . round (cmdist)  +  "  m" 

)  ; 

} 

} 

} 

//  — > 

</ script> 

<!--  Draw  Map  --> 

<div  id="map_canvas "  style="center ;  height:  512px"></div> 

</body> 

</html> 
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APPENDIX  IV.  FIELD  TEST  IMAGES 


Figure  19.  Base  Station. 


Figure  20.  Subscriber  Station. 
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Figure  2 1 .  Collection  V chicle  with  Roof  Mounted  Antenna. 


Figure  22.  Collection  Suite  (GPS,  Laptop,  and  WaveJudge). 
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Screen  Shot  of  WaveJudge  Interface  with  Captured  RNG-RSP  Open. 
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Figure  23 
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APPENDIX  V.  MULTIPLE  BASE  STATION  SIMULATIONS 


A.  TWO  BASE  STATIONS  THROUGH  VARYING  ANGLES 


1.  Two  Base  Stations  Through  Varying  Angle  MATLAB  Code 


%  Two  Base  Station  Simulation  Varying  Angle 
%  LT  D.  E.  Barber,  NFS  GSEAS 
%  Rev.  12,  1  Sept  2009 
clear  all; 


%  Measured  Timing  Adjust  Parameters  Based  on  Field  Measurements 
mTA  =  37;  %Mean  meters  per  Unit  of  Timing  Adjust 

stdTA  =  0.673;  %Mean  TA  standard  deviation 


%  Synthetic  Base 
SiteMean  =  1000; 
SiteSD  =  300; 


Station  Distance  Parameters 
%Mean  Site  Distance 
%Site  Standard  Deviation 


circlePts  =  30;  %  Number  of  points  in  circle  plots 

t  =  ( 0  :  circlePts )  "^2 "^pi/circlePts ; 


%  Initialize  Arrays 

AngAvg  =  0;  errorDist  =  0; 

for  i  =  0:18  %Iterate  Angles  in  10  Degree  Steps 

theta  =  i^pi/18;  %Angle  from  Subscriber  to  Base  Station  2 

for  j  =  1:100000  %Repeated  Runs  to  Average 

%  Distance  to  Simulated  Base  Stations  with  X/Y  Coordinates 
DistBSl  =  SiteSD^randn ( 1 )  +  SiteMean;  xl=DistBSl; 

%BS  on  Axis 

DistBS2  =  SiteSD'^randn  ( 1 )  +  SiteMean;  x2=cos  (theta) '*'DistBS2  ; 

y2=sin  (theta)  "^DistBSS; 


%  Timing  Adjust  for  Base  Stations  including  Random  Variation 
TABSl  =  round  (DistBSl/mTA)  +  round  ( stdTA'^randn  ( 1 ))  ; 

TABS2  =  round  (DistBS2/mTA)  +  round  (stdTA'^randn(l)); 


%  Site  Radii  based  on  TA 

sir  =  TABSl  ^  mTA;  s2r  =  TABS2  ^  mTA; 


%  Inter-Site  Distance  via  Pythag  and  Angle  from  ATAN2 
dist  =  sqrt  (  (x2-xl )  ^2  +  (y2-yl)'^2); 

phi  =  atan2 ( (y2-yl) , (x2-xl) ) ; 

%  Find  Midpoint  Between  Circles  or  Circle  Intersections 
if (dist>slr+s2r )  %  Separated  Radii 
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yl=0; 


deltaR=dist-slr-s2r  ; 
mpX=xl+cos (phi) ^ (slr+0 . S^deltaR) ; 
mpY=yl  +  sin  (phi)  (slr+0  .  S'^deltaR)  ; 
elseif  (dist<abs ( slr-s2r ) )  %  Contained  Circles 

if  (slr>s2r) 

deltaR=slr-s2r-dist  ; 
mpX=xl+cos (phi) ^ (slr-0 . S^deltaR) ; 
mpY=yl  +  sin  (phi)  (slr-0  .  S'^deltaR)  ; 
else 

deltaR=s2r-slr-dist ; 

mpX=xl  +  cos  (phi)  (-slr-0  .  S'^deltaR)  ; 

mpY=yl  +  sin  (phi)  (-slr-0  .  S'^deltaR)  ; 

end 

else  %  Intersections 

slmp=  (slr'^slr-s2r'^s2r+dist'^dist)  /  (2'^dist)  ;  %  Distance  BSl  to  Midpoint 
mpY^xl  +  slmp"^  (x2-xl)  /dist; 
mpY=yl  +  slmp'^  (y2-yl)  /dist; 
end 

%  Distance  from  Midpoint  to  Subscriber  at  Origin 
errorDist(j)  =  sqrt (mpX^2+mpY^2 ) ; 

end 

AngAvg (i  +  1) =mean (errorDist)  ; 

%  Plot  Once  Every  Other  Angle 
if  mod ( i , 2 ) ==0 
figure (i/2+1 ) ; 
clf  ; 

hold  on; 
axis  equal; 

title (['Base  Station  1  on  X  Axis,  Base  Station  2  at 

int2str ( i^lO ) ,  '  Degrees']); 

xlabel ( ' Meters ' ) ; ylabel ( ' Meters ' ) ; 

plot ( slr^cos ( t )  +  xl,  slr^sin(t)+  yl,'-b'); 

plot  ( s2r'^cos  ( t )  +  x2,  s2r'^sin(t)+  y2,'-m'); 

plot (xl , yl , ' ^b ' , ' Markers ize ' , 10 ) ;  plot (x2 , y2 , ' ^m ' , ' Markers ize ' , 10 ) ; 
plot (mpX, mpY, ' rp ' , ' Markers ize ',10) ;  plot(0,0, 'sk', ' Markers ize ' , 10 ) ; 
hold  off; 
end 

end 
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2, 


Two  Base  Stations  through  Varying  Angles  Example  Plots 


Base  Station  1  on  XAxis,  Base  Station  2  at  0  Degrees 


Meters 


Base  Station  1  on  XAxis,  Base  Station  2  at  40  Degrees 


Base  Station  1  on  XAxis,  Base  Station  2  at  80  Degrees 
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Base  Station  1  on  XAxis,  Base  Station  2  at  120  Degrees 
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Figure  24.  Sample  Plots  from  2  BS  Simulation  with  Varying  Angles  and  Distances. 


(Triangles  denote  the  BSs,  a  square  indicates  the  SS  location  ,  and  the  star  shows 
approximation  center  point.) 
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B. 


MULTIPLE  BASE  STATIONS 


1.  Multiple  Base  Stations  MATLAB  Code 

%  Multiple  Base  Station  Simulation 
%  LT  D.  E.  Barber,  NFS  GSEAS 
%  Rev.  14,  11  Nov  2009 
clear  all; 

%  Simulation  Parameters 

MaxNumberBS  =10;  %  Maximum  Number  of  Base  Stations  to  Simulate 
Runs  =  100000;  %  Number  of  Runs  at  Each  Number  of  Base  Stations 


%  Measured  Timing  Adjust  Parameters  Based  on  Field  Measurements 
mTA  =37;  %  Mean  meters  per  Unit  of  Timing  Adjust 

stdTA  =  0.673;  %  Mean  TA  standard  deviation 


%  Synthetic  Base 
SiteMean  =  1200; 
SiteSD  =  400; 


Station  Distance  Parameters 
%  Mean  Site  Distance 
%  Site  Standard  Deviation 


circlePts  =  180;  %  Number  of  points  in  circle  plots 

t  =  ( 0  :  circlePts )  "^2 "^pi/circlePts ; 

AvgError  =  0 : MaxNumberBS-2 ;  %  Average  Error  at  N  Base  Stations 

StdError  =  0 : MaxNumberBS-2 ;  %  Standard  Deviation  at  N  Base  Stations 

CEP  =  0 :MaxNumberBS-2;  %  CEP  at  N  Base  Stations 


%  Number  of  Base  Stations  to  Simulate 
for  N  =  2 : MaxNumberBS 


%  init 
DistBS 
bsX  = 
bsY  = 
bsTA  = 
sr  =  z 
infix 
intlY 
int2X 
int2Y  ^ 
intX  = 
intY  = 
DSE  = 


ialize  Sized 
=  zeros ( 1 , N) 
zeros ( 1 A  N)  ; 
zeros ( 1 , N) ; 

zeros ( 1 A  N)  ; 
eros ( 1 A  N) ; 

=  zeros ( 1 , N) ; 
=  zeros ( 1 , N) ; 
=  zeros ( 1 , N) ; 
=  zeros ( 1 A  N)  ; 
zeros ( 1 A  N)  ; 
zeros ( 1 , N) ; 
zeros ( 1 , Runs ) 


Arrays 
;  %  Array 

%  Array 
%  Array 
%  Array 
%  Array 
%  Array 
%  Array 
%  Array 
%  Array 
%  Array 
%  Array 
;  %  Array 


for  h  =  1 : Runs 


to  Hold  Distance  to  Base  Stations 
of  Base  Station  X  Coordinates 
of  Base  Station  Y  Coordinates 
of  Timing  Adjusts 
of  Site  Radius 

for  X  Coordinate  of  First  intercept 
for  Y  Coordinate  of  First  intercept 
for  X  Coordinate  of  Second  intercept 
for  Y  Coordinate  of  Second  intercept 
for  Chosen  intercept  from  Pair's  X  Coord 
for  Chosen  intercept  from  Pair's  Y  Coord 
of  Distances  to  Estimate  Center  Point 


%  Create  Base  Stations 

for  i  =  1:N  %  Number  of  Base 

DistBS  (i)  =  SiteSD'^randn  ( 1 )  +  SiteMean; 

theta  =  2 '^pi'^rand  ( 1 )  ; 
bsX(i)  =  cos (theta) ^DistBS (i); 


Stations 

%  Base  Station  Distance 
%  Angle  from  Subscriber 
%  X  Coordinate 
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bsY  (i)  =  sin  (theta)  "^DistBS  (i)  ;  %  Y  Coordinate 

bsTA(i)  =  round  (DistBS  (i) /mTA)  +  round  ( stdTA'^randn  ( 1 ))  ;  %  Timing  Adjust 
sr(i)  =  bsTA(i)  mTA;  %  Radius  from  Timing  Adjust 

end 


%  Find  Two  Intersections  for  Each  Pair  of  Radii 
for  a  =  1 : N 

b  =  mod (a, N) +1 ; 


%  Inter-Site  Distance  via  Pythag  and  Angle  from  ATAN2 
dist  =  sqrt ( (bsX (b) -bsX (a) ) ^2  +  (bsY (b) -bsY (a) ) ^2 ) ; 
phi  =  atan2 ( (bsY (b) -bsY (a) ) , (bsX (b) -bsX (a) ) ) ; 


%  Find  Midpoint  Between  Circles  or  Circle  Intersections 
if (dist>sr (a) +sr (b) )  %  Separated  Radii 

deltaR=dist-sr (a) -sr (b) ;  %  Closest  Point  Set  as  Both  Intersections 

in tlx (a) =bsX (a) +COS (phi) ^ (sr (a) +0 . S^deltaR) ; 
intlY (a) =bsY (a) +sin (phi) ^ (sr (a) +0 . S^deltaR) ; 
int2X (a) =intlX (a) ;  int2Y (a) =intlY (a) ; 
elseif  (dist<abs ( sr (a) -sr (b) ) ) %  Contained  Circles 

if ( sr (a) >sr (b) )  %  Narrowest  Set  as  Both  Intersections 

deltaR=sr (a) -sr (b) -dist; 

intlX (a) =bsX (a) +cos (phi) ^ (sr (a) -0 . S^deltaR) ; 
intlY (a) =bsY (a) +sin (phi) ^ (sr (a) -0 . S^deltaR) ; 
int2X (a) =intlX (a) ;  int2Y (a) =intlY (a) ; 
else 

deltaR=sr (b) -sr (a) -dist; 

intlX (a) =bsX (a) +cos (phi) ^ (-sr (a) -0 . 5^deltaR) ; 
intlY  (a) =bsY (a) +sin (phi) ^ (-sr (a) -0 . S^deltaR) ; 
int2X (a) =intlX (a) ;  int2Y (a) =intlY (a) ; 

end 


else 

slmp= (sr (a) ^2-sr 
mp2i=sqrt (sr (a) ^ 
mpX=bsX (a) +slmp^ 
mpY=bsY (a) +slmp^ 
intlX (a) =mpX+mp2 
intlY (a) =mpY-mp2 
int2X (a) =mpX-mp2 
int2Y (a) =mpY+mp2 
end 
end 


%  Intersections 


(b)  '"2+dist"2)  /  (2^dist)  ; 
2-slmp^2 ) ; 

(bsX (b) -bsX (a) ) /dist; 
(bsY (b) -bsY (a) ) /dist; 
i^  (bsY (b) -bsY (a) ) /dist; 
i^ (bsX (b) -bsX (a) ) /dist; 
i^  (bsY (b) -bsY (a) ) /dist; 
i^  (bsX (b) -bsX (a) ) /dist; 


%  Dist  from  BSl  to  Midpoint 
%  Dist  Midpoint  to  Intercept 
%  Midpoint  X  Coordinate 
%  Midpoint  Y  Coordinate 
%  First  Intersection  Coord 

%  Second  Intersection  Coord 


%  Select  Closest  Proximity  Intersection  from  Each  Pair 
for  j  =  1 : N 

k  =  mod ( j +1 , N) +1  ; 

distFirst=sqrt  (  (intlX  (k)  -intlX  ( j  )  )  ^2+  (intlY  (k)  -intlY  ( j  )  )  ^^2)  ; 
distl2=sqrt  (  (int2X  (k)  -intlX  ( j  )  )  '^2+  (int2Y  (k)  -intlY  ( j  )  )  ^^2)  ; 
if  (distl2  <  distFirst) 
distFirst  =  distl2; 

end 


distSecond=sqrt ( (intlX (k) -int2X ( j ) ) ^2+ (intlY (k) -int2Y ( j ) ) ^2) ; 
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dist22=sqrt ( (int2X (k) -int2X ( j ) ) ^2+ (int2Y (k) -int2Y ( j ) ) ^2) ; 
if  (dist22  <  distSecond) 
distSecond  =  dist22; 

end 

if  (distFirst  <  distSecond)  %  Store  Selected  Intersection  in  Array 
intX(j)  =  intlX(j);  intY(j)  =  intlY(j); 

else 

intX(j)  =  int2X(j);  intY(j)  =  int2Y(j); 

end 

end 

%  Approx  Center  of  Polygon  from  Selected  Intersections  by  Coord  Mean 
EstimateX  =  mean(intX); 

EstimateY  =  mean(intY); 

%Distance  from  Subscriber  to  Estimate 
DSE(h)  =  sqrt (EstimateX^2+EstimateY^2) ; 
end 


AvgError (N-1 )  =  mean(DSE); 

StdError (N-1)  =  std(DSE); 

CEP (N-1)  =  median (DSE); 


Mean  Estimate  Error  at  N  Stations 
Standard  Deviation  of  Error 
Circular  Error  Prob  at  N  Stations 


%  Plot 
figure (N-1 ) 
clf  ; 

hold  on; 
axis  equal; 

title ([ int2str (N) ,  '  Base  Stations,  '  int2str (DSE (h) ) ,  . 

'  Meters  from  Estimate  to  Subscriber']); 
xlabel ( ' Meters ' ) ; ylabel ( ' Meters ' ) ; 
for  p  =  1 : N 

plot  (bsX  (p)  ,  bsY  (p)  ,  ' '^b  '  ,  '  MarkerSize  '  ,  8 )  ;  %  Plot 

plot  ( sr  (p)  "^cos  ( t )  +  bsX(p),  sr  (p)  "^sin  ( t )  +  bsY(p));%  Plot 
plot  ( intlX (p) , intlY (p) ,  ' ob ' ,  ' MarkerSize ' , 4 ) ;  %  Plot 

plot  ( int2X (p) , int2Y (p) ,  ' ob ' ,  ' Markers ize ' , 4 ) ; 
plot  ( intX (p) , intY (p) ,  ' rd ' ,  ' Markers ize ' , 10 ) ; 
end 

plot ( 0 , 0 ,  ' sk '  ,  ' MarkerSize ' , 12 ) ;  %  Plot 

plot (EstimateX, EstimateY, ' rp MarkerSize 12 ) ;  %  Plot 

hold  off; 


Base  Station 
TA  Radius 
Both  Int 


Mark  Selected  Int 


Subscriber 

Estimated 


end 
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2, 


Random  Angle  and  Distance  Example  Plots 


3  Base  Stations,  8  Meters  from  Estimate  to  Subscriber  4  5330  Stations,  25  Meters  from  Estimate  to  Subscriber 
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Figure  25.  Sample  Multilple  BS  Plots  with  Random  Angles  and  Distances. 


Triangles  denote  BSs,  the  square  indicates  the  SS  location,  dots  mark  iterated 
intersections,  diamonds  mark  selected  intersections,  and  a  star  shows  approximation 
center  point. 
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3.  Evenly  Spaced  Angles  with  Random  Distance  Example  Plots 


3  Base  Stations,  35  Meters  from  Estimate  to  Subscriber 
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4  Base  Stations,  27  Meters  from  Estimate  to  Subscriber 
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5  Base  Stations,  36  Meters  from  Estimate  to  Subscriber 
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6  Base  Stations,  7  Meters  from  Estimate  to  Subscriber 
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Figure  26.  Sample  Multilple  BS  Plots  with  Equal  Angles  and  Random  Distances. 


Triangles  denote  BSs,  the  square  indicates  the  SS  location,  dots  mark  iterated 
intersections,  diamonds  mark  selected  intersections,  and  a  star  shows  approximation 
center  point. 
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4.  Evenly  Spaced  Angles  with  Fixed  Radial  Distance  Example  Plots 


3  Base  Stations,  25  Meters  from  Estimate  to  Subscriber  4  Base  Stations,  0  Meters  from  Estimate  to  Subscriber 


0 

0 


1500 

1000 

500 

0 

-500 

-1000 

-1500 


Meters 


5  Base  Stations,  0  Meters  from  Estimate  to  Subscriber 


6  Base  Stations,  12  Meters  from  Estimate  to  Subscriber 


Figure  27. 


Sample  Multilple  BS  Plots  with  Equal  Angles  and  Fixed  1  km  Distances. 


Triangles  denote  BSs,  the  square  indicates  the  SS  location,  dots  mark  iterated 
intersections,  diamonds  mark  selected  intersections,  and  a  star  shows  approximation 
center  point. 
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